Accessing files from Ghostscript commands with -dSAFER - ghostscript

Question

I'm trying to write a number of gs commands for server-side use. The user-provided PDF/JPEG files, I have to work with cannot be assumed to be safe (broken or even malicious files could be provided). Therefore, I'm trying to write all of my Ghostscript commands with -dSAFER, to guarantee at least a basic level of security.
Unfortunately, -dSAFER appears to be incompatible with certain gs commands. Take for example the following command:
# count number of pages in PDF
gs -dQUIET -dBATCH -dNOPAUSE -dNOSAFER -dNODISPLAY \
-c "(input.pdf) (r) file runpdfbegin pdfpagecount = quit"
How would you re-write this command with -dSAFER? The command fails if I just add -dSAFER, because gs can't read the file input.pdf (which is what I expect). How do I tell gs that is permitted to read input.pdf, but nothing else? Maybe there's a way to permit reading of files only from certain directories?
Here's a second example command:
# convert JPEG to single-page PDF
gs -dQUIET -dBATCH -dNOPAUSE -dNOSAFER \
-sDEVICE=pdfwrite -dCompatibilityLevel=1.5 -dPDFSettings=/printer \
-sColorConversionStrategy=Gray -dProcessColorModel=/DeviceGray \
-sOutputFile=output.pdf \
viewjpeg.ps \
-c "(input.jpg) << /PageSize 2 index viewJPEGgetsize 2 array astore >> setpagedevice viewJPEG"
This command has exactly the same problem as the first one. How do I re-write this with -dSAFER?
Please include a link to the relevant documentation in your answer if you think that -dSAFER is really not needed for my commands.

Answer 1

You can add directories to the search list using -I, IIRC any such directory is permitted to be read. For the current directory you can also use -P- and -P.
See Use.htm in the ghostpdl/doc directory.
However, even if adding the current directory allows you to read the file, this will soon stop working with -dSAFER anyway. There's an ongoing programme to 'harden' the interpreter when -dSAFER is set by hiding/remobing any non-standard operators especially if there's any possibility they could be misused.
Your proposed usage is, simply, incompatible with -dSAFER. The commands you are using will almost certainly be specifically prohibited because they are inherently unsafe. Essentially by messing about inside PDF files like that, your PostScript program is unsafe.
Of course, you know that your PostScript program is safe, and since you are not executing any part of the PDF, the PDF is also safe. The PDF would only be unsafe if you attempted to actually execute the contents, which your program doesn't do. It simply opens the file reads the Pages tree, and tells you the value associated with the Count key.
So you don't need to set -dSAFER in this particular example anyway. However any such program which did execute the PDF content (eg by rendering any part of it, or sending it to the pdfwrite device) would not be safe.
Your second example also doesn't need SAFER, since a JPEG can't contain code to access the disk.