Re: possible issue with ps2pdf (9.25) and transparency

At 10:55 17/09/2018 +0200, Johannes Meixner wrote:

>On Sep 15 19:43 Ken Sharp wrote (excerpt):
>>If you want to use non-standard PostScript extensions,
>>then you can't use SAFER,
>>this doesn't seem unreasonable to me.
>
>I think that by default any PostScript interpreter
>(in particular Ghostscript) should not support
>anything that is not standard PostScript.
>
>I assume currently this is not possible but I would appreciate it
>when in a future Ghostscript version any non-standard PostScript
>extension would only be supported when a special command line
>option was explicitly specified that enables the extension.

I'm afraid that such a setup would break many existing applications which 
use Ghostscript. I know from experience that, were we to implement such a 
change, we would spend years fending off bug reports such as:

  'Regression: Ghostscript no longer works with <insert name of 
application> since version X.xx'

Since some of these applications are poorly maintained (or no longer 
maintained at all) we would then have little choice but to revert the 
change or break compatibility with that application, which would make 
people unhappy. I know it would, I get the emails :-(

In addition, some of the extension operators are required if the PDF 
interpreter is to work. The Ghostscript PDF interpreter is (largely) 
written in PostScript and in particular needs a group of operators such as 
runpdf, runpdfpagerange etc in order to operate. Also a number of these 
operators are used directly by our commercial customers so we can't simply 
deprecate them

Personally I'd like to do it, but I don't think its likely that we will 
implement such a thing.


>Such a special command line option would be different
>from what '-dSAFER' is intended to do.
>
>Because standard PostScript supports arbitrary file access
>on the system disk via standard PostScript operators like
>'file', 'readstring', 'writestring', ... and 'closefile'
>a special command line option like '-dSAFER' is needed
>to make Ghostscript "safer" than standard PostScript.
>
>See the subsection
>"Other parameters" in "Command line options" in
>https://ghostscript.com/doc/9.25/Use.htm
>how '-dSAFER' is intended to limit file access.

Well -dSAFER no longer merely limits file access, and its pretty clear that 
people have been blindly using 'SAFER' for years (decades even) without any 
understanding of what its limitations are or were. Sadly most people don't 
read documentation.

"Safer sounds like a good idea, lets set that".....

We should probably update the documentation but as you know we were in 
something of a hurry for this release.


In truth, its rare for PostScrip programs to really be written in such a 
way as to require disk access, such applications are (generally) hand 
written special purpose programs, and I don't think its unreasonable to 
expect people to specifically say 'I need disk access'. In the same vein 
though, I don't think its unreasonable to expect that the same should apply 
to non-standard operators.

Fundamentally I'm pretty happy with bundling the whole file system and 
non-standard operator usage together, if you want to do dangerous stuff, 
then you can't use SAFER.

Note that there is a (very long standing) comment in Use.htm to making 
SAFER the default. We've never implemented that, but its possible we may do 
so now. In which case, in order to use the non-standard operators (or disk 
access) you would have to specify NOSAFER on the command line. Note that 
the operators we can't do away with would still be available even without that.

Wwe have a staff meeting in under 2 weeks where I anticipate that security 
will be a topic of discussion..... I'll bring your point up there and see 
what everyone else has to say (I shall also practice my pre-emptive 
ducking  ;-)


                     Ken