Mark Elkins via Exim-users <exim-users@???> (Do 12 Nov 2020 07:22:44 CET):
> One could do this for a punycode version of the domain name but the address
> part before an '@' can be UTF8 - such as "café". Please don't break any
> internationalised addresses (Universal Acceptance and all that). I'm
> wondering if an inverse check could be done, as in look for anything bad?
> (e.g. Double dots and slashes)
IMHO we're not going to check if an address (local_part, domain) is
valid. (For local_parts we have example ACL entries)
We're talking about the usage the "taintness" data. And even a valid
local_part is tainted. And, depending on how I use it, the valid local
part may be dangerous (e.g. for constructing path names).
And - as I pointed out already, not the pure existence/non-existence of
characters is enough to judge, if a given value can be considered as
safe. Though there might be valid use cases, where pure filtering is
sufficient (phone numbers), and other use cases, where the position of
the characters is important (pathnames).
So, I vote for methods to check if a given tainted value is safe for a
given use case. May this be done by lookups, or by specialized
functions.
Best regards from Dresden/Germany
Viele Grüße aus Dresden
Heiko Schlittermann
--
SCHLITTERMANN.de ---------------------------- internet & unix support -
Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} -
gnupg encrypted messages are welcome --------------- key ID: F69376CE -
