Add security support

crates/bridge_core/src/lib.rs

@@ -764,6 +764,11 @@ impl SecuritySettings {
     pub fn allow_shell_escape(&self) -> bool {
         !self.disable_insecures
     }
+
+    /// Query whether we're allowed to specify extra paths to read files from.
+    pub fn allow_extra_search_paths(&self) -> bool {
+        !self.disable_insecures
+    }
 }
 
 impl Default for SecuritySettings {

src/driver.rs

@@ -1071,12 +1071,18 @@ impl ProcessingSessionBuilder {
         // move this out of self to get around borrow checker issues
         let hidden_input_paths = self.hidden_input_paths;
 
-        let extra_search_paths = self
-                .unstables
+        let extra_search_paths = if self.security.allow_extra_search_paths() {
+            self.unstables
                 .extra_search_paths
                 .iter()
                 .map(|p| FilesystemIo::new(p, false, false, hidden_input_paths.clone()))
-                .collect();
+                .collect()
+        } else {
+            if !self.unstables.extra_search_paths.is_empty() {
+                tt_warning!(status, "Extra search path(s) ignored due to security");
+            }
+            Vec::new()
+        };
 
         let filesystem = FilesystemIo::new(&filesystem_root, false, true, hidden_input_paths);
 

tests/executable.rs

@@ -819,4 +819,11 @@ fn extra_search_paths() {
         "\\input 1.tex\n\\bye",
     );
     error_or_panic(&output);
+
+    let output = run_tectonic_with_stdin(
+        tempdir.path(),
+        &[&fmt_arg, "-", "-Zsearch-path=subdirectory/content", "--untrusted"],
+        "\\input 1.tex\n\\bye",
+    );
+    error_or_panic(&output);
 }