Author: Michael Haardt Date: To: Evgeniy Berdnikov via Exim-users Subject: Re: [exim] Taint checker confusing error (blaming file but caused
by later ldap lookup)
Evgeniy Berdnikov via Exim-users <exim-users@???> wrote: > Think a bit. Lot of examples may be found in one minute.
> For example, you have to check user's quota, which is stored in some
> database. You have to extract current maibox size, quota limit, then
> add message size to box size and compare with limit.
> It's natural to use runtime variables, isn't it?
In that example static analysis can decide which variables are tainted
and which are not. The variable values change at runtime, that is all.
> If you have to check sender's address against recipient's whitelist,
> you have to extract this whitelist, break down to separate items, and
> run a loop over each.
Again the variable value changes, but you can decide statically if
it will be tainted.
You did not answer what's the use case of variables that may be either
tainted or not, not allowing Exim to tell if a configuration is correct
at startup.
> > I did not mean to imply taint checking was not needed, but the opposite:
> > Saying "it's documented you should quote things" does not work.
>
> If it does not work for you, then some day you would get a hit to read
> documentation carefully. :)
Please see the OP question and answer to that. If it would not have been
for the domain list, Exim would have parsed tainted data and given the
message sender full control over the LDAP URL suffix.
