Re: [exim] 4.94 - De-tainting without lookup?

Top Page
Delete this message
Reply to this message
Author: Matthias Hörmann
Date:  
To: Jeremy Harris
CC: exim-users
Subject: Re: [exim] 4.94 - De-tainting without lookup?
Hello

This essentially gets me back to where I started. I *want* any domains
and local parts to be created as part of this process. I can live with
the case where it won't create paths with dangerous characters (that
never happened on dozens of servers in years of using this config,
possibly because we filter addresses for valid characters in our ACLs)
but I can not live with having to know any possible domain and local
part in advance.

Matthias Hörmann

The 2020-06-27 13:09:02, Jeremy Harris via Exim-users wrote:
> On 27/06/2020 12:51, Evgeniy Berdnikov via Exim-users wrote:
> >> # directory must exist
> > ^^^^^^^^^^^^^^^^^^^^^^^^
> > The question is what to do if it does not exist? It's impossible to predict
> > addressees of arbitrary mail list, so no way to create subdirs in advance.
>
> Then you'll need to take specific action to create these directories
> outside exim. I hope you impose suitable constraints (which your
> previous method did not appear to, and a blind method for de-tainting
> strings without actually validating them would still not).
> --
> Cheers,
> Jeremy
>
> --
> ## List details at https://lists.exim.org/mailman/listinfo/exim-users
> ## Exim details at http://www.exim.org/
> ## Please use the Wiki with this list - http://wiki.exim.org/


--
Mit freundlichen Grüßen,

Matthias Hörmann

fon: +49 (0) 521 - 329647-29
fax: +49 (0) 521 - 329647-40
email: matthias.hoermann@???

---------------
saltation GmbH & Co. KG | Niederwall 43 | 33602 Bielefeld
Sitz Bielefeld | Amtsgericht Bielefeld HRA 15344
Persönlich haftende Gesellschafterin:
saltation Beteiligungs-GmbH | Niederwall 43 | 33602 Bielefeld
Sitz Bielefeld | Amtsgericht Bielefeld HRB 39339
Geschäftsführer: Daniel Brün
---------------

Wir erfüllen unsere Informationspflichten gem. Artt. 13-14 DS-GVO
durch Veröffentlichung auf unserer Internetseite unter

https://www.saltation.com/de/datenschutzerklaerung.html

oder durch Zusendung auf Ihre formlose Anfrage.