How to safely compile arbitrary LaTeX code? #30

New Issue

2024-07-24T16:02:44+02:00

Benjamin_Loison commented

2024-07-24 16:02:44 +02:00

I have in mind https://www.overleaf.com/project/624bebbd68fefad2562d8b93.

Should ask a search engine the question as is.

Otherwise concerning arbitrary shell command execution I found the Stack Overflow question 3252957.

https://www.texdev.net/2009/10/06/what-does-write18-mean/

If I remember correctly for working with SVGs or/and PDFs Inkscape is involved and requires modifying Kile compilation parameters. Maybe svg-inkscape folders are related.

Maybe Settings > Configure Kile... > Tools > Build > Select a tool > PDFLaTeX > Choose a configuration for the tool PDFLaTeX > General > Options: --shell-escape.

To leverage #12.

I have in mind https://www.overleaf.com/project/624bebbd68fefad2562d8b93. Should ask a search engine the question as is. Otherwise concerning arbitrary shell command execution I found [the Stack Overflow question 3252957](https://stackoverflow.com/q/3252957). https://www.texdev.net/2009/10/06/what-does-write18-mean/ If I remember correctly for working with SVGs or/and PDFs Inkscape is involved and requires modifying Kile compilation parameters. Maybe `svg-inkscape` folders are related. Maybe *Settings* > *Configure Kile...* > *Tools* > *Build* > *Select a tool* > *PDFLaTeX* > *Choose a configuration for the tool PDFLaTeX* > *General* > *Options*: *--shell-escape*. To leverage #12.

Benjamin_Loison commented

2024-07-24 16:06:11 +02:00

Related to Improve_websites_thanks_to_open_source/issues/713.

Related to [Improve_websites_thanks_to_open_source/issues/713](https://codeberg.org/Benjamin_Loison/Improve_websites_thanks_to_open_source/issues/713).

Benjamin_Loison commented

2024-07-24 22:30:56 +02:00

\immediate\write18{pwd > pwd_output.txt}
\immediate\write18{/usr/bin/pwd > pwd_output.txt}

Source: the Stack Overflow answer 3253068

create a file next to the \LaTeX file.

Just printing the result of the command to the document is also interesting, see the Stack Overflow answer 3254927.

\input{|"date"}

makes quite clear what compilation the output is coming from.

If I remove Kile above compilation parameter I get File |date.tex' not found. \input{|"date"}` error that I was not having and no PDF is generated.

So the question is what correct usage do I have of this command and how can I only allow such usage?

Also have to pay attention with more external modifications with Overleaf usage, that I do not compile for instance when just opening Kile and it compiles automatically a potentially malicious change.

```bash \immediate\write18{pwd > pwd_output.txt} \immediate\write18{/usr/bin/pwd > pwd_output.txt} ``` Source: [the Stack Overflow answer 3253068](https://stackoverflow.com/a/3253068) create a file next to the $\LaTeX$ file. Just printing the result of the command to the document is also interesting, see [the Stack Overflow answer 3254927](https://stackoverflow.com/a/3254927). ```bash \input{|"date"} ``` makes quite clear what compilation the output is coming from. If I remove Kile above compilation parameter I get `File `|date.tex' not found. \input{|"date"}` error that I was not having and no PDF is generated. So the question is what correct usage do I have of this command and how can I only allow such usage? Also have to pay attention with more external modifications with Overleaf usage, that I do not compile for instance when just opening Kile and it compiles automatically a potentially malicious change.

Benjamin_Loison commented

2024-07-24 23:04:34 +02:00

What about pdflatex command? Knowing this may help #31.

What about `pdflatex` command? Knowing this may help #31.

Benjamin_Loison commented

2024-07-25 14:59:37 +02:00

Related to Benjamin-Loison/latex2e/issues/10.

Related to [Benjamin-Loison/latex2e/issues/10](https://github.com/Benjamin-Loison/latex2e/issues/10).

Benjamin_Loison commented

2024-07-28 04:25:49 +02:00

Related to overleaf/wiki/Server-Pro:-Sandboxed-Compiles/156e2d963dcba80b7047491eb58993b84479e725, #20 and #10.

Related to [overleaf/wiki/Server-Pro:-Sandboxed-Compiles/156e2d963dcba80b7047491eb58993b84479e725](https://github.com/overleaf/overleaf/wiki/Server-Pro:-Sandboxed-Compiles/156e2d963dcba80b7047491eb58993b84479e725), #20 and #10.

Benjamin_Loison referenced this issue

2025-03-11 22:58:40 +01:00

`\usepackage{svg}` does not work on own instances #42

Benjamin_Loison commented

2025-08-30 17:05:11 +02:00

Related to #21#issuecomment-4189.

yu-i-i/overleaf-cep/issues/{44,49,61}

are the only relevant issues based on their titles.

Related to [#21#issuecomment-4189](https://gitea.lemnoslife.com/Benjamin_Loison/overleaf/issues/21#issuecomment-4189). [yu-i-i/overleaf-cep/issues/](https://github.com/yu-i-i/overleaf-cep/issues){[44](https://github.com/yu-i-i/overleaf-cep/issues/44),[49](https://github.com/yu-i-i/overleaf-cep/issues/49),[61](https://github.com/yu-i-i/overleaf-cep/issues/61)} are the only relevant issues based on their titles.

Benjamin_Loison commented

2026-10-20 22:38:51 +02:00

The instance:

is also concerned by this issue.

/var/lib/sharelatex/data/compiles/XXXXXXXXXXXXXXXXXXXXXXXX-XXXXXXXXXXXXXXXXXXXXXXXX

/var/lib/sharelatex/data/compiles 5260 entries

Oct 19 20:11
...
Oct 20 20:17

Personal notes:

<details> <summary>The instance:</summary> ``` -----BEGIN PGP MESSAGE----- hF4DTQa9Wom5MBgSAQdAA3YlCxzAEj5FJUki+R8RTGdFEL7QBs1/2uMTJmXTMxgw qMIiLBzNP0cfX8POIOu225dqF0FKTOI6z5ESY3BskgcNuQvdhrwTcHoy/stWlQOZ 0q0BJRCLNNgO3uqDJAcdsnVW3ZrUXmYqDjr60o/UjD2mv99F94D9ZLE78uZ/e1xP SFOHfnUmDzdD2sULy4OcDtVUjhTAg6G4Ek4mjpqQ9Unu5ucSBZVNrNjYIyY4bpbZ In51jjTB8mLZaXl/mDfJZcAPNiQE4qtjOpQSDF2zlXVAvJrIZwo0k0WpQ7Yc/exE upUai7Va2czl23cyr0FYKu6CvYW09IMruGGgdDPM6g== =1J5j -----END PGP MESSAGE----- ``` </details> is also concerned by this issue. /var/lib/sharelatex/data/compiles/XXXXXXXXXXXXXXXXXXXXXXXX-XXXXXXXXXXXXXXXXXXXXXXXX /var/lib/sharelatex/data/compiles 5260 entries ``` Oct 19 20:11 ... Oct 20 20:17 ``` <details> <summary>Personal notes:</summary> ``` -----BEGIN PGP MESSAGE----- hF4DTQa9Wom5MBgSAQdAiHNbmJBXHmNegDdxJlCyuec4JGTA0BCGaENDPgqnpzIw aDHGLl94p5TkLGNKVkTfoaoC2lP/V1pw69Nc26WVcOIsOyUjSTl2DlRAWp1sif88 0o4ByMMb2/6Q0I5o2KgpFiRQbDrsP0PsSdY9/3rMo23l8NG4Ymnh9BKmUminOBHn mKR0F83jlR8D/s4FmuJaTAUFc+QQKQ7fdr11YO6SrBaF89cq4oXVXFPVKuPLQ0xT 0N7cPfP8IE0OVHVx7ip1HXhEHL6uR24Iz6SgCZVWQcSESSe7OoIUCD9H0LpsfZ3t =vEvN -----END PGP MESSAGE----- ``` </details>

Benjamin_Loison commented

2026-10-27 15:36:16 +01:00

I have read:

I have verified that the person I have contacted by Mattermost private message has a badge:

System Admin

<details> <summary>I have read:</summary> ``` -----BEGIN PGP MESSAGE----- hF4DTQa9Wom5MBgSAQdAgWp0r8I7jDVtLNWb+AQk/aY/RsvKrZE9RrTmYGtHp1Aw DeiWcTe6D8OxvNaDpfQ0b9HVWX1p1sljmFRpHDnc9W7Zil4d9TSGLSAc2RfwX9Nh 0n4Bzej9j8vyka42pgExJIg/6iLduJc0dNCKtpo2uAuVEoFsFdARJc84WQTMzVLf oGxEdbcrY0TK6afTotKGULbOTA+W0byiC9e1iEamOT1cCyzIFL9i2o22byIHwh++ 6kSH2eHsLQyRCVJberooc1VIVri3ZgC1KM7tHB8zuc4= =+OWd -----END PGP MESSAGE----- ``` </details> I have verified that the person I have contacted by Mattermost private message has a badge: > System Admin

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Benjamin_Loison/overleaf#30