Re: [exim] Database lookup tainted

Kezdőlap
Üzenet törlése
Válasz az üzenetre
Szerző: exim.org
Dátum:  
Címzett: Jeremy Harris, exim-users
Tárgy: Re: [exim] Database lookup tainted
Emails are neither accepted nor delivered and show "Temporary internal error" in log.

Here's a bit more of the log file:


12:19:39.351 12159   ├──expanding: servers=127.0.0.1/xx/xx/xx; SELECT string_agg(DISTINCT userid,',') AS target FROM aliases WHERE address='${quote_pgsql:$local_part@$domain}';
12:19:39.351 12159   ╰─────result: servers=127.0.0.1/xx/xx/xx; SELECT string_agg(DISTINCT userid,',') AS target FROM aliases WHERE address='xx@xxxx';
12:19:39.351 12159              ╰──(tainted)
12:19:39.352 12159  search_open: pgsql "NULL"
12:19:39.352 12159  search_find: file="NULL"
12:19:39.352 12159    key="servers=127.0.0.1/xx/xx/xx; SELECT string_agg(DISTINCT userid,',') AS target FROM aliases WHERE address='xx@xxx';" partial=-1 affix=NULL starflags=0 opts=NULL
12:19:39.352 12159  LRU list:
12:19:39.352 12159  internal_search_find: file="NULL"
12:19:39.352 12159    type=pgsql key="servers=127.0.0.1/xx/xx/xx; SELECT string_agg(DISTINCT userid,',') AS target FROM aliases WHERE address='xx@xxxx';" opts=NULL
12:19:39.352 12159  database lookup required for servers=127.0.0.1/xx/xx/xx; SELECT string_agg(DISTINCT userid,',') AS target FROM aliases WHERE address='xx@xxxx';
12:19:39.352 12159  PostgreSQL query: "servers=127.0.0.1/xx/xx/xx; SELECT string_agg(DISTINCT userid,',') AS target FROM aliases WHERE address='xx@xxxx';" opts 'NULL'
12:19:39.352 12159  lookup deferred: PostgreSQL server "127.0.0.1/xx/xx/xx" is tainted
12:19:39.352 12159  ├failed to expand: ${lookup pgsql {servers=127.0.0.1/xx/xx/xx; SELECT string_agg(DISTINCT userid,',') AS target FROM aliases WHERE address='${quote_pgsql:$local_part@$domain}';}}
12:19:39.352 12159  ╰───error message: lookup of "servers=127.0.0.1/xx/xx/xx; SELECT string_agg(DISTINCT userid,',') AS target FROM aliases WHERE address='xx@xxxx';" gave DEFER: PostgreSQL server "127.0.0.1/xx/xx/xx" is tainted
12:19:39.352 12159 db_aliases router: defer for xx@xxxx
12:19:39.352 12159   message: failed to expand "${lookup pgsql {servers=127.0.0.1/xx/xx/xx; SELECT string_agg(DISTINCT userid,',') AS target FROM aliases WHERE address='${quote_pgsql:$local_part@$domain}';}}": lookup of "servers=127.0.0.1/xx/xx/xx; SELECT string_agg(DISTINCT userid,',') AS target FROM aliases WHERE address='xx@xxxx';" gave DEFER: PostgreSQL server "127.0.0.1/xx/xx/xx" is tainted
12:19:39.352 12159 ----------- end verify ------------
12:19:39.352 12159 require: condition test deferred in ACL "acl_check_rcpt"


and here's acl_check_rcpt:

acl_check_rcpt:
  accept  hosts          = :


  deny    message        = Restricted characters in address
          domains        = +local_domains
          local_parts    = ^[.] : ^.*[@%!/|]


  deny    message        = Restricted characters in address
          domains        = !+local_domains
          local_parts    = ^[./|] : ^.*[@%!] : ^.*/\\.\\./


  accept  local_parts    = postmaster
          domains        = +local_domains


  require verify         = sender


  accept  hosts          = +relay_from_hosts
          control        = submission


  accept  authenticated  = *
          control        = submission/sender_retain


  deny    message        = Invalid sender for sending domain (SPF)
          spf            = fail


# set acl_m1 for whitelist recipients, evaluated in acl_check_data
  accept  recipients     = +whitelist_recipients
          set   acl_m_wl = accepted


  accept  domains        = +relay_to_domains
          verify         = recipient/callout=10s,defer_ok


  accept  domains        = +local_domains
          sender_domains = !+local_domains
          verify         = recipient


deny



2. Juni 2020 14:06, "Jeremy Harris via Exim-users" <exim-users@???> schrieb:

> On 02/06/2020 12:12, exim.org--- via Exim-users wrote:
>
>> However after updating to 4.94 I only get errors like this (private details replaced):
>>
>> 2:19:39.350 12159 ╭considering: ${lookup pgsql {servers=127.0.0.1/mydb/mydbuser/mydbpw; SELECT
>> string_agg(DISTINCT userid,',') AS target FROM aliases WHERE
>> address='${quote_pgsql:$local_part@$domain}';}}
>> 12:19:39.351 12159 ╭considering: servers=127.0.0.1/mydb/mydbuser/mydbpw; SELECT string_agg(DISTINCT
>> userid,',') AS target FROM aliases WHERE address='${quote_pgsql:$local_part@$domain}';}}
>> 12:19:39.351 12159 ╭considering: $local_part@$domain}';}}
>> 12:19:39.351 12159 ├──expanding: $local_part@$domain
>> 12:19:39.351 12159 ╰─────result: myuser@???
>> 12:19:39.351 12159 ╰──(tainted)
>
> You don't say in what fashion it is not working. The taint in that
> position is not an error.
>
>> What do I have to change to make this work again?
>> What is the reason it says tainted?
>
> The content (of both) of the variables being expanded came from a
> source we cannot trust, it being a potential attacker. For this
> reason it is tagged as "tainted".
> --
> Cheers,
> Jeremy
>
> --
> ## List details at https://lists.exim.org/mailman/listinfo/exim-users
> ## Exim details at http://www.exim.org
> ## Please use the Wiki with this list - http://wiki.exim.org