Fix TexManager's support for openin_any = p
#23804
Conversation
openout_any = popenin_any = p
There was a problem hiding this comment.
Thank you for opening your first PR into Matplotlib!
If you have not heard from us in a while, please feel free to ping @matplotlib/developers or anyone who has commented on the PR. Most of our reviewers are volunteers and sometimes things fall through the cracks.
You can also join us on gitter for real-time discussion.
For details on testing, writing docs, and our review process, please see the developer guide
We strive to be a welcoming and open project. Please follow our Code of Conduct.
The "paranoid" default of Kpathsea (TeX Live's path resolution system) disallows access to parent directories.
6810ca8 to
19e6417
Compare
|
@jtracey Thanks and congratulations on your first contribution to Matplotlib. We hope to see you back. |
|
@tacaswell @QuLogic should we backport to 3.6.x? AFAICS as long as we have not released 3.6.0 we cannot port to 3.6.1? Correct? |
|
On what systems or version of TeX is this a problem? I cannot confirm that the given test actually fails without this change. |
|
@QuLogic this was a default Debian Stretch install, which right now seems to be using |
|
Scratch that, even though that's where I cam across the bug, it looks like the test does indeed pass in that environment. The test does fail in my dev environment though, which is Ubuntu 20.10, running texlive edit to add: I'll take a closer look to see why the test only sometimes fails, given that I see the buggy behavior in both. |
PR Summary
Because of the security implications of being able to read/write arbitrary files, even with user permissions, TeX's path resolution system kpathsea restricts file access by default. While most configs overwrite this with more permissive options, a secure setup (particularly in settings where TeX is being supplied from untrusted inputs) should have
openin_any = pin the system'stexmf.cnfor equivalent. This setting disallows, among other things, traversal to parent directories.PR #21414 worked around a problem with paths that contain
~by traversing through the parent:matplotlib/lib/matplotlib/texmanager.py
Line 298 in 25b39d4
That code makes it impossible to use TeX with the default settings, even if the
TEXMFOUTPUTandMPLCONFIGDIRenvironment variables are set appropriately to allow it. This PR reorganizes access to the same directory structure to use only child directories, which are allowed.PR Checklist
Tests and Styling
pytestpasses).flake8-docstringsand runflake8 --docstring-convention=all).Documentation
doc/users/next_whats_new/(follow instructions in README.rst there).doc/api/next_api_changes/(follow instructions in README.rst there).