Re: [exim] 4.96 and UUCP

On 28/06/2022 12:22, Markus Reschke via Exim-users wrote:
> IIRC, the 'recommended' way to solve issues with tainted variables is to perform a database lookup.

Actually, that is better phrased as "The requirement is to not use values provided
by potential attackers in sensitive situations" - and the common means of
not doing so is to obtain values from a trusted place, using (if needed) those
untrusted values as search keys.

Assuming there really is no way for you to use a pure SMTP environment
(i.e. dump UUCP), or somehow avoid using a pipe transport (I can't think
of a way offhand), any method here is going to be somewhat hacky. The
least-worst is probably to wrap your uux invocation in another program
(shell script, perl script, custom binary) which picks up the environment
variable $RECIPIENT.
--
Cheers,
Jeremy