FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

SEC: Block shell escapes in latex and ps commands by scottshambaugh · Pull Request #31282 · matplotlib/matplotlib · GitHub

/ matplotlib Public

SEC: Block shell escapes in latex and ps commands - #31282

Merged
WeatherGod merged 1 commit into
matplotlib:mainfrom
scottshambaugh:tex_no_shell
Mar 13, 2026
ConversationCommits (1)ChecksFiles changed
Merged

SEC: Block shell escapes in latex and ps commands#31282
WeatherGod merged 1 commit into
matplotlib:mainfrom
scottshambaugh:tex_no_shell

Conversation

scottshambaugh commented Mar 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

PR summary

See the discussion in #31249

This blocks our LaTeX and ps commands from arbitrary code execution in the shell:

AI Disclosure

Claude used for the audit (found a few more spots to hit!), code manually reviewed

PR checklist

scottshambaugh added the Release critical For bugs that make the library unusable (segfaults, incorrect plots, etc) and major regressions. label Mar 11, 2026
scottshambaugh mentioned this pull request Mar 11, 2026
Closed
1 task
WeatherGod reviewed Mar 11, 2026
View reviewed changes
Comment thread lib/matplotlib/texmanager.py Outdated

tacaswell commented Mar 11, 2026

Copy link
Copy Markdown
Member

Looks like the -R0 came in in 2006 via c0d6110 (in the SVN days!).

tacaswell added this to the v3.11.0 milestone Mar 11, 2026

scottshambaugh commented Mar 11, 2026

Copy link
Copy Markdown
Contributor Author

It's possible switching away from -R0 breaks something, but we should fix it some other way should that be the case.

tacaswell approved these changes Mar 11, 2026
View reviewed changes

tacaswell left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

I am indifferent to settling on one or two - on latex cli args or leaving as-is.

scottshambaugh added the Security Hardening Proactive security hardening. Existing vulnerabilities should be reported per our security policy label Mar 12, 2026

WeatherGod commented Mar 12, 2026

Copy link
Copy Markdown
Member

In principle, I approve these changes, but I don't know if the test failure is one of the spurious failures or actually related to these changes.

tacaswell commented Mar 13, 2026

Copy link
Copy Markdown
Member

Someone must have re-run them, I'm only seeing a codecov failures but it is short an upload so I am not worried.

WeatherGod merged commit 8ff895d into matplotlib:main Mar 13, 2026
63 of 67 checks passed
andreas16700 added a commit to andreas16700/matplotlib that referenced this pull request Mar 16, 2026
Run 8ff895d: Merge pull request matplotlib#31282 from scottshambaugh/…
d698c8a 
…tex_no_shell
andreas16700 added a commit to andreas16700/matplotlib that referenced this pull request Mar 16, 2026
Run 8ff895d: Merge pull request matplotlib#31282 from scottshambaugh/…
b173772 
…tex_no_shell

ksunden commented Apr 17, 2026

Copy link
Copy Markdown
Member

@meeseeksdev please backport to v3.10.x

lumberbot-app Bot commented Apr 17, 2026

Copy link
Copy Markdown

Owee, I'm MrMeeseeks, Look at me.

There seem to be a conflict, please backport manually. Here are approximate instructions:

  1. Checkout backport branch and update it.
git checkout v3.10.x
git pull
  1. Cherry pick the first parent branch of the this PR on top of the older branch:
git cherry-pick -x -m1 8ff895d0750f3b16c3214b38a91ad78029c82df7
  1. You will likely have some merge/cherry-pick conflict here, fix them and commit:
git commit -am 'Backport PR #31282: SEC: Block shell escapes in latex and ps commands'
  1. Push to a named branch:
git push YOURFORK v3.10.x:auto-backport-of-pr-31282-on-v3.10.x
  1. Create a PR against branch v3.10.x, I would have named this PR:

"Backport PR #31282 on branch v3.10.x (SEC: Block shell escapes in latex and ps commands)"

And apply the correct labels and milestones.

Congratulations — you did some good work! Hopefully your backport PR will be tested by the continuous integration and merged soon!

Remember to remove the Still Needs Manual Backport label once the PR gets merged.

If these instructions are inaccurate, feel free to suggest an improvement.

ksunden mentioned this pull request Apr 21, 2026
Closed
5 tasks
timhoffm pushed a commit that referenced this pull request Apr 22, 2026
Merge pull request #31282 from scottshambaugh/tex_no_shell
acc6024 
SEC: Block shell escapes in latex and ps commands
(cherry picked from commit 8ff895d)

The test that was edited had significant updates on main, so the old
test was kept on backport and no similar call exists in the old test.
timhoffm added a commit that referenced this pull request Apr 22, 2026
Merge pull request #31545 from ksunden/backport-of-pr-31282-on-v3.10.x
a4f57ab 
Backport PR #31282 on branch v3.10.x (SEC: Block shell escapes in latex and ps commands)
ksunden mentioned this pull request Apr 24, 2026
Merged
5 tasks
rgommers mentioned this pull request Apr 24, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

tacaswell tacaswell approved these changes
WeatherGod WeatherGod approved these changes

Assignees

No one assigned

Labels

backend: pgf backend: ps Release critical For bugs that make the library unusable (segfaults, incorrect plots, etc) and major regressions. Security Hardening Proactive security hardening. Existing vulnerabilities should be reported per our security policy

Projects

None yet

Milestone

v3.11.0

Development

Successfully merging this pull request may close these issues.

5 participants

Back | FazBrowse Home | New Git URL