On 28/06/2022 12:22, Markus Reschke via Exim-users wrote:
IIRC, the 'recommended' way to solve issues with tainted variables is to perform a database lookup.
Actually, that is better phrased as "The requirement is to not use values provided by potential attackers in sensitive situations" - and the common means of not doing so is to obtain values from a trusted place, using (if needed) those untrusted values as search keys. Assuming there really is no way for you to use a pure SMTP environment (i.e. dump UUCP), or somehow avoid using a pipe transport (I can't think of a way offhand), any method here is going to be somewhat hacky. The least-worst is probably to wrap your uux invocation in another program (shell script, perl script, custom binary) which picks up the environment variable $RECIPIENT. -- Cheers, Jeremy -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list - http://wiki.exim.org/
