[Bug 3181] New: sql lookup taints '@' in domain list

https://bugs.exim.org/show_bug.cgi?id=3181

            Bug ID: 3181
           Summary: sql lookup taints '@' in domain list
           Product: Exim
           Version: 4.99
          Hardware: x86-64
                OS: Solaris
            Status: NEW
          Severity: bug
          Priority: medium
         Component: List matching
          Assignee: [email protected]
          Reporter: [email protected]
                CC: [email protected]

with exim 4.98.2 I have been successfully using a sql lookup in local_domains
list:

domainlist local_domains = @ : localhost : localhost.localdomain : pgsql;SELECT
DISTINCT fqdn FROM mailboxes WHERE fqdn = '${quote_pgsql:$domain}';

after upgrading to 4.99 this produces panic logs:
attempt to use tainted list metadata @

so it looks like '@' gets tainted due to the sql lookup (if I remove the sql,
the error disappears; also if I remove '@' there are no errors...).

I can work around with:
domainlist pgsql_lookup = pgsql;SELECT DISTINCT fqdn FROM mailboxes WHERE fqdn
= '${quote_pgsql:$domain}';
domainlist local_domains = @ : localhost : localhost.localdomain :
+pgsql_lookup

which does not give any errors.

Is this change of behaviour intentional?

-- 
You are receiving this mail because:
You are on the CC list for the bug.