https://bugs.exim.org/show_bug.cgi?id=3181
Bug ID: 3181
Summary: sql lookup taints '@' in domain list
Product: Exim
Version: 4.99
Hardware: x86-64
OS: Solaris
Status: NEW
Severity: bug
Priority: medium
Component: List matching
Assignee: [email protected]
Reporter: [email protected]
CC: [email protected]
with exim 4.98.2 I have been successfully using a sql lookup in local_domains
list:
domainlist local_domains = @ : localhost : localhost.localdomain : pgsql;SELECT
DISTINCT fqdn FROM mailboxes WHERE fqdn = '${quote_pgsql:$domain}';
after upgrading to 4.99 this produces panic logs:
attempt to use tainted list metadata @
so it looks like '@' gets tainted due to the sql lookup (if I remove the sql,
the error disappears; also if I remove '@' there are no errors...).
I can work around with:
domainlist pgsql_lookup = pgsql;SELECT DISTINCT fqdn FROM mailboxes WHERE fqdn
= '${quote_pgsql:$domain}';
domainlist local_domains = @ : localhost : localhost.localdomain :
+pgsql_lookup
which does not give any errors.
Is this change of behaviour intentional?
--
You are receiving this mail because:
You are on the CC list for the bug.
--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-dev.lists.exim.org/
## unsubscribe (doesn't require an account):
## [email protected]
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
