Re: [exim] Tainted arg 2 for mailman_transport transport com…

Top Page
Delete this message
Reply to this message
Author: Andrew C Aitchison
Date:  
To: Exim users list
CC: Thomas Krichel
Subject: Re: [exim] Tainted arg 2 for mailman_transport transport command
On Wed, 20 Jul 2022, Andrew C Aitchison via Exim-users wrote:

> On Wed, 20 Jul 2022, Thomas Krichel via Exim-users wrote:
>> root@darni /etc/exim4 # cat ./conf.d/transport/14_exim4-config_mailman
>> mailman_transport:
>>  driver  = pipe
>>  command = MM_WRAP \
>>          '${if def:local_part_suffix \
>>                {${sg{$local_part_suffix}{-(\\w+)(\\+.*)?}{\$1}}} \
>>                {post}}' \
>>          $local_part
>>  current_directory = MM_HOME
>>  home_directory    = MM_HOME
>>  user              = MM_UID
>>  group             = MM_GID

>>
>> just what the instruction say ... Here is my router
>>
>> root@darni /etc/exim4 # cat ./conf.d/router/114_exim4-config_mailman | grep 
>> -v ^\#
>> mailman_router:
>>  driver            = accept
>>  domains           = +mm_domains
>>  require_files     = MM_LISTCHK
>>  local_part_suffix_optional
>>  local_part_suffix = -admin     : \
>>         -bounces   : -bounces+* : \
>>         -confirm   : -confirm+* : \
>>         -join      : -leave     : \
>>         -owner     : -request   : \
>>         -subscribe : -unsubscribe
>>  transport         = mailman_transport

>>
>> Here is my template, again with comments left out for brefty
>>
>> root@darni /etc/exim4 # cat conf.d/main/template_14_exim4-config_mailman |
>> grep -v ^\#
>> MM_HOME=/var/lib/mailman
>> MM_UID=list
>> MM_GID=list
>> domainlist mm_domains=lists.openlib.org
>> MM_WRAP=MM_HOME/mail/mailman
>> MM_LISTCHK=MM_HOME/lists/${lc::$local_part}/config.pck
>>
>> A manual check of MM_LISTCHK suggests that nep-techncians
>> should be found since the config.pck is there.
>>
>> root@darni ~ # ls /var/lib/mailman/lists/nep-technicians/config.pck
>> /var/lib/mailman/lists/nep-technicians/config.pck
>>
>> What more to check?
>
> You have checked everything, but you need to use an untainted
> value in command. Based on
>  echo /var/lib/mailman/lists/nep-technicians/config.pck |\
>      sed -e 's/\/config.pck\$//' -e 's/\/.*\///g'config.pck
> (the order of the replacements matters)
> could you try replacing your transport with:

>
> mailman_transport:
>  driver  = pipe
>  command = MM_WRAP \
>          '${if def:local_part_suffix \
>                {${sg{$local_part_suffix}{-(\\w+)(\\+.*)?}{\$1}}} \
>                {post}}' \
>          ${sg{sg{$local_part}{\/config.pck$}{}}{.*\/}{}}
>  current_directory = MM_HOME
>  home_directory    = MM_HOME
>  user              = MM_UID
>  group             = MM_GID

>
> ?
> I don't have an exim config system with MM_LISTCHK
> and I have never tested the sg function in an exim config before,
> so this is unlikely to be exactly right.


I was right that this was wrong :-(
Please try
     ${sg{sg{$}{\/config.pck$}{MM_LISTCHK}}{.*\/}{}}
instead.


-- 
Andrew C. Aitchison                      Kendal, UK
                    andrew@???