From b84ea4740f3279516905c5db05f4074e777c16ff Mon Sep 17 00:00:00 2001

From: Han-Wen Nienhuys <hanwenn@gmail.com>

Date: Tue, 21 Jul 2020 14:45:08 +0200

Subject: [PATCH 1/1] scm: disable embedded-ps and embedded-svg in -dsafe mode

This prevents executing privileged PostScript and exploiting

Ghostscript vulnerablilities

Tested:

 $ lilypond -dsafe input/regression/les-nereides.ly

 (works, kinda)

 $ cat f.ly

 { c4_ \markup \postscript #" (x) show " }

 $ lilypond -dsafe f

 Preprocessing graphical objects.../home/hanwen/vc/lilypond/out/share/lilypond/current/scm/define-markup-commands.scm:1145:3: In procedure ly_make_stencil in expression (ly:make-stencil (list # #) (quote #) ...):

  /home/hanwen/vc/lilypond/out/share/lilypond/current/scm/define-markup-commands.scm:1145:3: Wrong type argument in position 1 (expecting registered stencil expression): (embedded-ps "

---

 scm/define-stencil-commands.scm | 65 ++++++++++++++++++++++-------------------

 1 file changed, 35 insertions(+), 30 deletions(-)

diff --git a/scm/define-stencil-commands.scm b/scm/define-stencil-commands.scm

index 09a2299..e388788 100644

--- a/scm/define-stencil-commands.scm

+++ b/scm/define-stencil-commands.scm

@@ -21,36 +21,41 @@

 (define-public (ly:all-stencil-commands)

   "Return the list of stencil commands that can be

 defined in the output modules (@file{output-*.scm})."

-  '(blank

-    char

-    circle

-    dashed-line

-    draw-line

-    ellipse

-    embedded-ps

-    embedded-svg

-    end-group-node

-    glyph-string

-    grob-cause

-    named-glyph

-    no-origin

-    page-link

-    path

-    partial-ellipse

-    placebox

-    polygon

-    resetcolor

-    resetrotation

-    resetscale

-    round-filled-box

-    setcolor

-    setrotation

-    setscale

-    start-group-node

-    text

-    unknown

-    url-link

-    utf-8-string

+  (let*

+      ((commands '(blank

+                   char

+                   circle

+                   dashed-line

+                   draw-line

+                   ellipse

+                   end-group-node

+                   glyph-string

+                   grob-cause

+                   named-glyph

+                   no-origin

+                   page-link

+                   path

+                   partial-ellipse

+                   placebox

+                   polygon

+                   resetcolor

+                   resetrotation

+                   resetscale

+                   round-filled-box

+                   setcolor

+                   setrotation

+                   setscale

+                   start-group-node

+                   text

+                   unknown

+                   url-link

+                   utf-8-string

+                   )))

+

+    (if (ly:get-option 'safe)

+        commands

+        (append '(embedded-ps embedded-svg)

+                commands))

     ))

 ;; TODO:

-- 

1.9.1