[exim/exim] [RFE] Tainted search query should require quoting (Issue #3213)
jgh via Exim-dev <[email protected]> Mon, 06 Apr 2026 11:11:16 +0100
| Newsgroups | gmane.mail.exim.devel |
|---|---|
| Message-ID | <exim/exim/issues/[email protected]> |
--------------- Feature Summary --------------- Enable the #ifdeffed-out enforcement of quoting on query-style lookups. ----------------- Problem Statement ----------------- Security issue: poorly written configs can use attacker-supplied data directly in SQL queries. These can use SQL syntax elements to do unexpected operations. We have config facilities for quoting such queries, which fixes the issue, and we do track if they are used. Currently (since 4.96) we only log violations; we need to move to enforcement. ----------------- Proposed Solution ----------------- Remove the #ifdef at search.c 628. Retain the debug. --- View it on Exim Forgejo ( https://code.exim.org/exim/exim/issues/3213 ) or reply to this email directly.