(Apologies if this doesn't thread properly -- I am writing via email and
reading via Lurker...)
On 27/07/2020 19:45, Jamie Barnes via Exim-users wrote:
>> I've been avoiding check_local_user (since it tries to chdir into home
>> directories that the exim user has no access to), so I don't think
On 27/07/2020 19:45, Jamie Barnes via Exim-users wrote:> I've been avoiding
check_local_user (since it tries to chdir into home directories that the exim
user has no access to), so I don't think I have access to $local_part_data (as
nothing populates it).
Not so. Any lookup done by a
Hi all;
Firstly, just to note that I understand the purpose of tainting data, and
appreciate any improvements to security within Exim.
That said, I was already aware of the potential for bad variable data being
exposed to the server, and was removing non-alphanumeric characters from
On 6/29/20 12:18 PM, Kurt Jaeger via Exim-users wrote:
> One thing I'll test is if we hand values over to perl, maybe
> we'll get back untainted value...
>
> Or did me beat someone to that already ? 8-}
I did not test that, I would imagine that should work because how would
it really know what
Hi!
> That fact that string sub-sitution and matching parts don't even work
> now is a real problem...
>
> data = ${expand:"|/command -c ${if match
> {$local_part}{.*foo[\-\+]([a-z0-9]+).*}{$1}{}}"}
One thing I'll test is if we hand values over to perl, maybe
we'll get back untainted
That fact that string sub-sitution and matching parts don't even work
now is a real problem...
data = ${expand:"|/command -c ${if match
{$local_part}{.*foo[\-\+]([a-z0-9]+).*}{$1}{}}"}
Won't even work because matching only numbers and letters is still
considered "tainted".
Forcing
sequences,
its easy to, before the filter function, do a sg{} and replace all unwanted
sequences with a character outside the permitted space, and then run the
filter function.
-Ursprungligt meddelande-
Från: Evgeniy Berdnikov via Exim-users
Skickat: den 26 juni 2020 23:12
Till: exim-user
Hello.
On Thu, Jun 25, 2020 at 09:16:59PM +0100, Jeremy Harris via Exim-users wrote:
> On 25/06/2020 20:50, Evgeniy Berdnikov via Exim-users wrote:
> > at least in statement "In all other situations, this variable expands
> > to nothing", because it may be filled if no lookup is done.
>
>
On 25/06/2020 20:50, Evgeniy Berdnikov via Exim-users wrote:
> at least in statement "In all other situations, this variable expands
> to nothing", because it may be filled if no lookup is done.
Yes, that is no longer true. See the sections starting
On Thu, Jun 25, 2020 at 04:29:21PM +0100, Jeremy Harris via Exim-users wrote:
> You had "xxample.ru:" as your matching line. Key, and zero-length
> data.
Well. After reading docs several times and a series of experiments
with ACLs I came to the following conclusions:
1. Variable
On 2020-06-25 Evgeniy Berdnikov via Exim-users wrote:
[...]
> I run "Exim version 4.94 #2 built 19-Jun-2020 08:31:26" from Debian.
Hello,
Judging from the build date this should be
4.94-3, which is exim-4.94+fixes up to and including
ecf1e77accda6355ebb745a0a03e97ba7eb298b2 [Taint: fix verify.
On 25/06/2020 16:08, Evgeniy Berdnikov via Exim-users wrote:
processing "warn" (/var/lib/exim4/config.autogenerated 485)
check acl = test_domain_data
using ACL "test_domain_data"
processing "warn" (/var/lib/exim4/config.autogenerated 490)
check logwrite = before lookup
Hello.
The $domain_data variable is described in ch.9 of documentation with
statement
| $domain_data is also set when the domains condition in an ACL matches
| a domain by means of a lookup. The data read by the lookup is available
| during the rest of the ACL statement. In all other
Ken,
I already started to prepare a section about the motivation of tainting
and about how to de-taint.
Maybe I can share it before we include it into the official docs.
(As it keeps biting me too ;)
Best regards from Dresden/Germany
Viele Grüße aus Dresden
Heiko Schlittermann
--
Hi!
> The concept "de-tainting" appears in the index, but not in the manual.
Yes, but: Jeremy can't do all the heavy lifting all by himself.
We need to help him. Write docs etc.
--
p...@opsec.eu+49 171 3101372Now what ?
--
## List details at
Hi, Jeremy. This problem keeps coming up and you answer
From: Jeremy Harris via Exim-users
Date: Fri, 19 Jun 2020 13:29:00 +0100
Docs, concept index, de-tainting.
The concept "de-tainting" appears in the index, but not in the manual.
This index entry gets you to some useful
16 matches
Mail list logo
