IJS device - try and secure the IJS server startup

Bug #707051 ""ijs" device can execute arbitrary commands"

The problem is that the 'IJS' device needs to start the IJS server, and
that is indeed an arbitrary command line. There is (apparently) no way
to validate it. Indeed, this is covered quite clearly in the comments
at the start of the source:

 * WARNING: The ijs server can be selected on the gs command line
 * which is a security risk, since any program can be run.

Previously this used the awful LockSafetyParams hackery, which we
abandoned some time ago because it simply couldn't be made secure (it
was implemented in PostScript and was therefore vulnerable to PostScript
programs).

This commit prevents PostScript programs switching to the IJS device
after SAFER has been activated, and prevents changes to the IjsServer
parameter after SAFER has been activated.

SAFER is activated, unless explicitly disabled, before any user
PostScript is executed which means that the device and the server
invocation can only be configured on the command line. This does at
least provide minimal security against malicious PostScript programs.

1 files changed, 3 insertions, 1 deletions

diff --git a/devices/gdevijs.c b/devices/gdevijs.c
index 8cbd84b97..16f5a1752 100644
--- a/devices/gdevijs.c
+++ b/devices/gdevijs.c
@@ -888,6 +888,8 @@ gsijs_initialize_device(gx_device *dev)
     static const char rgb[] = "DeviceRGB";
     gx_device_ijs *ijsdev = (gx_device_ijs *)dev;
 
+    if (ijsdev->memory->gs_lib_ctx->core->path_control_active)
+        return_error(gs_error_invalidaccess);
     if (!ijsdev->ColorSpace) {
         ijsdev->ColorSpace = gs_malloc(ijsdev->memory, sizeof(rgb), 1,
                                        "gsijs_initialize");
@@ -1326,7 +1328,7 @@ gsijs_put_params(gx_device *dev, gs_param_list *plist)
     if (code >= 0)
         code = gsijs_read_string(plist, "IjsServer",
             ijsdev->IjsServer, sizeof(ijsdev->IjsServer),
-            dev->LockSafetyParams, is_open);
+            ijsdev->memory->gs_lib_ctx->core->path_control_active, is_open);
 
     if (code >= 0)
         code = gsijs_read_string_malloc(plist, "DeviceManufacturer",