[tex-live] ConTeXt in TL on Windows broken

T T t34www at googlemail.com
Tue Jun 1 21:18:11 CEST 2010


On 1 June 2010 17:49, Mojca Miklavec <mojca.miklavec.lists at gmail.com> wrote:
> On Tue, Jun 1, 2010 at 18:30, T T <t34www at googlemail.com> wrote:
>>
>> I don't understand.  If you were able to call 'texlua --version', I
>> don't see how mtxrun could fail (assuming it was started from the same
>> process/command window).  In both cases the same PATH had to be
>> searched for the binary, so it's impossible it succeeded in one case
>> and failed in another (windows is weird, but not that weird).
>
> I can imagine that windows has found the binary texlua.exe without a
> problem while mtxrun was trying to be more clever than windows and
> tried to find that binary on its own. Note that "%PATH" is not a valid
> folder or path.

I didn't thought that this "%PATH" was meant literally.  In that case
there is something really wrong with the installer.  I'm surpriced,
because we didn't change anything in install-tl related to path
setting, AFAIK.

> You don't need to understand.

Well, since making sure that things run smoothly on windows is a big
part of what I (try to) do in this project, I would like to understand
in case I got something wrong.

> Vyatcheslav had the same problem - his windows installer is

By "his windows installer" you mean install-tl, right?

> failing due to this weird behaviour of not finding texlua in current
> folder.

As I said earlier, this behaviour is intentional.

Consider the following scenario: you get a zipped document with a
rogue texlua.exe binary in it.  This binary has hidden atribute set
and therefore it won't even show up on the majority of windows systems
(by default hidden files are not shown).  With default search order
for binaries it is now enough to process this document to execute the
rogue program and gain full control.  Moreover, the attack is stealthy
- the user might never know about it.

It costed us a lot of time last year to prevent this kind of attacks
and TL release was delayed for weeks because of this.  I try not to be
too paranoid about security, but default settings should be such that
document processing should never allow arbitrary code execution behind
user's back.  That's at least my opinion on the matter.

Cheers,

Tomek



More information about the tex-live mailing list