Clarification: 1.2.8 LaTeX
Open
Nobody has claimed this yet.
2) Awaiting response
V1 (prev V5)
- Dominant language
- HTML
- Stars
- 3.6k
- Forks
- 832
- Avg merge
- 7h 55m
- Merged PRs (30d)
- 4
Description
1.2.8 Verify that LaTeX processors are configured securely (such as not using the “– shell‑escape”flag) and an allowlist of commands is used to prevent LaTeX injection attacks.
- An allowlist of LaTeX commands alone isn’t enough to prevent injection attacks, it can create a false sense of security. Also, sandboxing, which is a critical defense, isn’t mentioned in the requirement and I would recommend.
- If user input isn’t properly sanitized before processing, even allowed commands could be misused in unexpected ways. The current requirement doesn’t mention important terms input sanitization, restricted execution modes, or package control.
- Would it also make sense to cover DoS (Denial of Service) attacks here, or should that be addressed in a separate requirement?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the raw Markdown source for requirement 1.2.8 in the 5.0 version, rather than derived CSV, JSON, XLSX, PDF, or DOCX files. Review the existing wording against the concerns about sandboxing, input sanitization, restricted execution, package control, and denial of service. Done requires an agreed scope and finalized requirement wording.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- latex
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100