Re: [exim] 4.94 - De-tainting without lookup?

Startseite
Nachricht löschen
Nachricht beantworten
Autor: Evgeniy Berdnikov
Datum:  
To: exim-users
Betreff: Re: [exim] 4.94 - De-tainting without lookup?
On Mon, Jun 29, 2020 at 09:12:23AM +0200, Michael Haardt via Exim-users wrote:
> Partially dsearch does that by not allowing "." and ".." as keys.


It's pity, but it does... See thread
https://lists.exim.org/lurker/thread/20200625.134349.ed703108.en.html

> A lookup either returns data or fails, and that's exactly the interface
> verification needs.


I insist that dsearch MUST NOT return "." or ".." because those items
are special for majority of file systems, so they can not be used
to store data and are dangerous (!) to construct file path.
It seems better to exclude those items from scan list.

And there is no need to have two options "dir" and "subdir" which
differes only in application to "..". Such interface is redundant.
--
Eugene Berdnikov