{"push_id":1449319582,"size":1,"distinct_size":1,"ref":"refs/heads/check-mpost","head":"8379fba5a49d72dcc04dd335cbc8affd409bfd1a","before":"82ba9ef1dc607683249cf6cd0a701bc57308e95e","commits":[{"sha":"8379fba5a49d72dcc04dd335cbc8affd409bfd1a","author":{"name":"Akira Yokosawa","email":"0c7fc62659e086b475b989147db8e79dd6f82ad6@gmail.com"},"message":"Abort build if 'mpost' is present in sources\n\nA POC of an arbitrary command execution vulnerability in TeX config\nwas disclosed on November 28, 2016.\n\nTo avoid the exploitation, this commit adds checks just before latex\ninvocations in runfirstlatex.sh, runlatex.sh, and the \".tex -> .eps\"\nrule of Makefile.\n\nIf your setting is vulnerable, \"mpostcheck.sh\" displays a warning\nmessage even if \"mpost\" is not found. To make sure it can be noticed,\nthe script is also invoked at the end of runlatex.sh.\n\nRefer to the comment in mpostcheck.sh for the circumstances.\n\nSigned-off-by: Akira Yokosawa <akiyks@gmail.com>","distinct":true,"url":"https://api.github.com/repos/akiyks/perfbook/commits/8379fba5a49d72dcc04dd335cbc8affd409bfd1a"}]}
{"actor":{"display_login":"akiyks"}}