airship
airship copied to clipboard
paragonie
LaTeX
Per @co60ca in this tweet, I should look into supporting LaTeX->HTML parsers and add it to the format list.
As always, our priorities are:
- Security
- Usability
- Ease-of-integration (kludgy code is hard-to-audit code)
I will be shocked if there isn't already a well-written LaTeX -> HTML library written in PHP.
https://github.com/xemlock/php-latex Need to audit first, but looks promising.
Sorry, I don't think we'll be able to squeeze this in before v1.0.0, so I'm removing it from the milestone.
- In order to claim LaTeX support, we need to support macros.
- Supporting macros without RCE requires a level of security analysis beyond what I'm willing to invest at the moment.
- It turns out that the community doesn't have a rich supply of candidate libraries to choose from after all.
I'm not ruling this out.
Hi, I saw this issue and since you are prioritizing security I wanted to share this article: hacking with latex.
I'm not sure whether you're familiar with the article / hacking latex, nor do I know whether php-latex is vulnerable to the attacks described in the article (I'm assuming it is), but since it wasn't mentioned in this issue I thought it would be better to be safe than sorry. :smile:
Not that it matters, but couldn't you support a restricted LaTeX and claim "limited LaTeX support?" Or would removing macros make it pretty much unusable? (I don't use Macros directly)
It would probably depend on your use case. Your tweet seems to have disappeared, so I don't know the original motivation.
I often reuse a preamble.tex file which contains a few macros for representing vectors (giving them a bold face), norms, etc.
Removing macros would mean that most / all of my articles wouldn't compile.
Just a disclaimer: I'm by no means an "expert" in either LaTeX nor security.
There is no filesystem access here at all. That's critically important.
This is for blog posts, web pages, and comments that some end users without access to the filesystem can alter. HTML, Markdown, and RST are allowed because and only because there is no "read something from the file system" functionality exposed.
Should a great no-filesystem-access LaTeX parser written in PHP surface in the near future, I'll consider adding this format to the available text modes. Unfortunately, I don't have the time to audit or fork the existing ones to make them secure.
I'll leave this ticket open in case that happens.