Hi,
Moving an old system to exim 4.94.2 I'm hitting a taint error with
$dnslist_domain. That's a bit surprising as it's 100% internally defined
-- there's nothing the outside world can do to change its possible
values. Well, at least in my mind ;)
> warn domains = +vhost_domains
> dnslists = $acl_m_dnslist1
> add_header = X-Spam-Blacklisted: $dnslist_matched listed at $dnslist_domain ($dnslist_value)
> set acl_m105076_act = ${lookup{tag}lsearch{VHOST_DIR/$domain_data/VHOST_CONFIG_DIR/blacklists/$dnslist_domain}{tag}{reject}}
> logwrite = ACL#10/50/76: H=$sender_fullhost $dnslist_matched blacklisted at $dnslist_domain ($dnslist_value) - $domain_data set to $acl_m105076_act
>
> deny condition = ${if eq {$acl_m105076_act}{reject}}
> message = $dnslist_matched blacklisted at $dnslist_domain ($dnslist_value) \
> ${if def:dnslist_text {\n$dnslist_text}}
When there's an rbl hit, the lsearch lookup triggers a taint error, e.g:
> Tainted filename for search '/srv/example.com/config/blacklists/bl.mxrbl.com'
> failed to expand ACL string "${lookup{tag}lsearch{/srv/$domain_data/config/blacklists/$dnslist_domain}{tag}{reject}}"
(I haven't touched most of the config but $domain_data is innocent -- a
quick test replacing $dnslist_domain with a hardcoded "bl.mxrbl.com" and
all is well).
So, a bit of a dummy question (sorry), but how do I detaint
$dnslist_domain? Presumably, with a simple lookup -- by definition it's
in $acl_m_dnslist1 and the associated file will very likely still exist
at VHOST_DIR/$domain_data/VHOST_CONFIG_DIR/blacklists/$dnslist_domain ...
In case it's relevant, $acl_m_dnslist1 is populated via a filter looking
for the presence of various files, e.g:
> warn domains = +vhost_domains
> set acl_m_dnslist1 = ${filter{ \
> b.barracudacentral.org : \
> hostkarma.junkemailfilter.com=127.0.0.2 : \
> bl.mxrbl.com : \
> dbl.spamhaus.org!=127.0.1.255,127.255.255.252,127.255.255.254,127.255.255.255/$sender_address_domain : \
> hostkarma.junkemailfilter.com=127.0.0.2/$sender_address_domain : \
> dbl.nordspam.com==127.0.0.2/$sender_address_domain \
> } \
> {exists{VHOST_DIR/$domain_data/VHOST_CONFIG_DIR/blacklists/${extract{1}{=!&/}{$item}{$value}{$item}}}} \
> }
Hmm, I'm now wondering if $sender_address_domain has tainted dnslists,
parent of $dnslist_domain. I guess not.
Meanwhile, thanks for exim - and any pointers!
M
