Re: [exim] 4.94 - De-tainting without lookup?

トップ ページ
このメッセージを削除
このメッセージに返信
著者: Evgeniy Berdnikov
日付:  
To: exim-users
題目: Re: [exim] 4.94 - De-tainting without lookup?
On Mon, Jun 29, 2020 at 09:12:23AM +0200, Michael Haardt via Exim-users wrote:
> Partially dsearch does that by not allowing "." and ".." as keys.


It's pity, but it does... See thread
https://lists.exim.org/lurker/thread/20200625.134349.ed703108.en.html

> A lookup either returns data or fails, and that's exactly the interface
> verification needs.


I insist that dsearch MUST NOT return "." or ".." because those items
are special for majority of file systems, so they can not be used
to store data and are dangerous (!) to construct file path.
It seems better to exclude those items from scan list.

And there is no need to have two options "dir" and "subdir" which
differes only in application to "..". Such interface is redundant.
--
Eugene Berdnikov