Docling's opt-in Tectonic engine compiled untrusted TikZ with file access; a Claude-co-authored change in the fix narrowed its safety check, and 2.132.0 can still read local files.

-    # Tectonic opens any path the TeX source names, including absolute and-    # ``..`` paths, even with --untrusted. Untrusted sources are therefore-    # rendered only when every file reference is a literal relative path inside-    # the staging directory. Commands below either build control sequences or-    # file names indirectly (so a path cannot be checked from the source text),-    # or read or write files; any occurrence skips rendering. The list covers the-    # TeX primitives and common packages, not every package in the bundle.-    _UNSAFE_CONTROL_WORDS = frozenset(-        {-            # Indirect control sequences, catcodes and character codes-            "catcode", "lccode", "uccode", "lowercase", "uppercase", "csname",-            "endcsname", "ifcsname", "scantokens", "primitive", "makeatletter",-            "ExplSyntaxOn", "ExplSyntaxNamesOn", "ProvidesExplPackage",-            "ProvidesExplClass", "ProvidesExplFile", "UseName", "ExpandArgs",-            "csuse", "csdef", "csgdef", "csedef", "csxdef", "cslet", "csletcs",-            "letcs", "csexpandonce",-            # Primitive file access-            "openin", "read", "readline", "openout", "special", "XeTeXpicfile",-            "XeTeXpdffile", "directlua",-            # Package commands that read, embed or write files-            "IfFileExists", "InputIfFileExists", "lstinputlisting", "VerbatimInput",-            "BVerbatimInput", "LVerbatimInput", "verbatiminput", "inputminted",-            "pgfplotstableread", "pgfplotstabletypeset", "pgfplotstablesave",-            "CatchFileDef", "CatchFileEdef", "CatchFileBGroup", "csvreader",-            "csvloop", "csvautotabular", "csvautobooktabular", "csvautolongtable",-            "DTLloaddb", "DTLloadrawdb", "import", "subimport", "inputfrom",-            "includefrom", "subinputfrom", "subincludefrom", "includestandalone",-            "includesvg", "includepdf", "includeinkscape", "bibliography",-            "addbibresource", "externaldocument", "tikzexternalize", "pgfimage",-            "pgfdeclareimage", "readdef", "readarray", "embedfile", "attachfile",-            "textattachfile", "filecontents",-        }-    )  # fmt: skip-    # Commands whose braced argument names a file that is staged or looked up.-    _PATH_CONTROL_WORDS = frozenset({"input", "include", "includegraphics"})-    # Commands whose braced argument names packages, classes, libraries or-    # directories.-    _NAME_LIST_CONTROL_WORDS = frozenset(-        {-            "usepackage", "RequirePackage", "documentclass", "LoadClass",-            "usetikzlibrary", "usepgflibrary", "usepgfplotslibrary", "graphicspath",-        }-    )  # fmt: skip-    _CONTROL_SEQUENCE_PATTERN = re.compile(r"\\(?:([A-Za-z]+)|.)", re.DOTALL)-    _OPTIONAL_ARGUMENT_PATTERN = re.compile(r"\s*(?:\[(?:[^\[\]]|\[[^\[\]]*\])*\])?\s*")-    _SAFE_RELATIVE_PATH_PATTERN = re.compile(r"[A-Za-z0-9_][A-Za-z0-9_. /-]*")-    # pgfplots/TikZ keys and plot operations that read data files.-    _DATA_FILE_KEY_PATTERN = re.compile(-        r"search\s+path|read\s+from\s+file|(?<![A-Za-z\\])file\s*(?:\[[^\]]*\])?\s*\{"+    # Best-effort pre-check for untrusted sources: skip rendering when the

      def __init__(         self,@@ -157,117 +117,40 @@ def _sanitize_preamble_for_tectonic(cls, preamble: str) -> str:             r"\1% docling: removed for Tectonic compatibility: \2", preamble         ) -    @staticmethod-    def _braced_argument(text: str, pos: int) -> tuple[str, int] | None:-        """Return the balanced ``{...}`` group starting at ``pos`` and its end.--        Returns:-            The group content and the index after the closing brace, or ``None``-            when ``text[pos]`` is not ``{`` or the group is not closed.-        """-        if pos >= len(text) or text[pos] != "{":-            return None-        depth = 0-        index = pos-        while index < len(text):-            char = text[index]-            if char == "\\":-                index += 2-                continue-            if char == "{":

+    # Best-effort pre-check for untrusted sources: skip rendering when the+    # source names an absolute or parent-directory path for an input or+    # graphics file, or uses the TeX primitives that open arbitrary files. It+    # cannot see names built by macros or every way TeX can open files.+    _PATH_ARGUMENT_PATTERN = re.compile(+        r"\\(?P<command>input|include|includegraphics|InputIfFileExists|graphicspath)"+        r"(?![A-Za-z])\*?(?:\s*\[[^\]]*\])?\s*\{*\s*(?P<path>[^{}\s]*)"+    )+    _FILE_PRIMITIVE_PATTERN = re.compile(+        r"\\(?P<command>openin|openout|XeTeXpicfile|XeTeXpdffile)(?![A-Za-z])"+    )+     def __init__(         self,         timeout: float = 60.0,-        allow_shell_escape: bool = True,+        allow_shell_escape: bool = False,     ):+        """Create a Tectonic-backed render engine.++        Args:+            timeout: Maximum time in seconds for one Tectonic run.+            allow_shell_escape: Whether to pass ``-Z shell-escape``, which lets+                ``\\write18`` run shell commands. Only enable for trusted input.+                When ``False``, Tectonic runs with ``--untrusted`` and+                ``--only-cached``.+        """         self.cache_dir = Path.home() / ".cache" / "docling" / "tectonic"         self.binary_path = self.cache_dir / "tectonic"         self.timeout = timeout@@ -96,6 +117,41 @@ def _sanitize_preamble_for_tectonic(cls, preamble: str) -> str:             r"\1% docling: removed for Tectonic compatibility: \2", preamble         ) 

+                or re.match(r"[A-Za-z]:", path)+                or ".." in re.split(r"[/\\]", path)+            ):+                return f"\\{match.group('command')} with path {path!r}"+        return None++    @classmethod+    def _precheck_staged_files(cls, staging_dir: Path) -> bool:+        """Return whether no staged file refers to files outside ``staging_dir``."""+        for staged_file in staging_dir.rglob("*"):+            if not staged_file.is_file():+                continue+            unsafe = cls._find_unsafe_construct(+                staged_file.read_text(encoding="utf-8", errors="replace")+            )+            if unsafe is not None:+                _log.warning(+                    "Skipping TikZ rendering: %s contains %s, which refers to "+                    "files outside the rendering directory.",+                    staged_file.relative_to(staging_dir),+                    unsafe,+                )+                return False+        return True+     @staticmethod     def _strip_comments(text: str) -> str:         return re.sub(r"(?m)(?<!\\)%.*$", "", text)@@ -211,6 +267,21 @@ def _stage_local_dependencies(             staged_path.parent.mkdir(parents=True, exist_ok=True)             shutil.copy2(source_path, staged_path) +    def _build_command(self, tex_file: Path) -> list[str]:+        """Build the Tectonic command line for compiling ``tex_file``."""+        cmd = [str(self.binary_path)]+        if self.allow_shell_escape:+            # --untrusted would disable shell escape, so it is not added here.+            cmd.extend(["-Z", "shell-escape"])+        else:+            # --untrusted disables shell escape and extra search paths;+            # --only-cached prevents network fetches of bundle files.+            cmd.append("--untrusted")