Author: Jeremy Harris Date: To: exim-users Subject: Re: [exim] Exim 4.94: "Tainted filename for search: 'select'"
On 18/06/2020 13:20, Felix Schwarz via Exim-users wrote: > sqlite_dbfile = /path/to/user.db
>
> domainlist local_domains = sqlite;select DISTINCT domain from users where
> domain='${quote_sqlite:$domain}' and is_enabled=1;
Two problems.
- the <lookup-type> <semicolon> <file> syntax only applies for
single-key lookup types. sqlite is a query-style.
- that probably leads into the tainting problem, so I'll ignore that
> I assumed that "quote_sqlite" would untain the $domain value but it does not?
No, quoting is for protection against metacharacter intpretation
by sqlite, and has nothing to do with taint. An attacker could
use a domain name with some legal SQL embedded...
Use the ${lookup sqlite ...} syntax.
--
Cheers,
Jeremy
