PdfHandler shells out to pdftotext, convert, gs, and pdfinfo. All of these should be restricted using https://www.mediawiki.org/wiki/Manual:Shell_framework#Restrictions
convert and ps are already firejailed in Wikimedia production, but need to be converted to the MediaWiki framework
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Declined | None | T172584 Securing external binaries run by MediaWiki | |||
| Resolved | TheDJ | T182746 PdfHandler binaries should have shell restrictions applied to them |
The current command as I see it from pdftotext errors in Logstash:
/bin/bash '/srv/mediawiki/php-1.32.0-wmf.20/includes/shell/limit.sh' ''\''/usr/bin/pdftotext'\'' '\''/tmp/0ZSSAt'\'' '\''-'\''' 'MW_INCLUDE_STDERR=;MW_CPU_LIMIT=50; MW_CGROUP='\''/sys/fs/cgroup/memory/mediawiki/job'\''; MW_MEM_LIMIT=1048576; MW_FILE_SIZE_LIMIT=524288; MW_WALL_CLOCK_LIMIT=180; MW_USE_LOG_PIPE=yes'
I don't know since when it started using shell/limit or whether it always was, but, does this suffice for this task?
This is now using shellbox, so I’m assuming we can call this resolved. Pls reopen if not the case.