[exim/exim] [Bug]: exim-be can't place $ in a tainted variable (Issue #3224)

What is the problem environment ?
---------------------------------

Exim version 4.99.1-235-320482241 #1 built 08-Apr-2026 13:59:31
Copyright ( c ) The Exim Maintainers and contributors in ACKNOWLEDGMENTS file, 2007 - 2026
Copyright ( c ) University of Cambridge, 1995 - 2018

Hints DB:
Using sqlite3
Support for : Content_Scanning Local_Scan Exim_filter Sieve_filter crypteq Expand_dlfunc iconv () IPv6 PAM Perl GnuTLS move_frozen_messages TLS_resume DANE DKIM DNSSEC ESMTP_Limits ESMTP_Wellknown Event I18N OCSP PIPECONNECT PRDR PROXY Queue_Ramp SOCKS SPF SRS TCP_Fast_Open
Lookups ( built-in ) : cdb dbm dbmnz dbmjz dnsdb dsearch ldap ldapdn ldapm ldapauth iplsearch lsearch nwildlsearch wildlsearch nis nis0 passwd pgsql redis sqlite spf readsock
Authenticators ( built-in ) :  cram_md5 cyrus_sasl dovecot external gsasl plaintext spa tls
Routers ( built-in ) :  accept dnslookup ipliteral iplookup manualroute redirect queryprogram
Transports ( built-in ) :   appendfile/maildir/mailstore/mbx autoreply lmtp pipe smtp
Malware: clamd avast sock cmdline
Fixed never_users: 0
Configure owner: 0:0
Size of off_t:8 ptr:8 long:8 int:4
Configuration file is /dev/null

What happened?
--------------

exim -be REPL doesn't accept dollar signs directly into tainted variables.

> set,t acl_m_foo=100\$
2026-05-12 01:32:51 attempt to expand tainted string '100\$'
oops: NULL

however it can be done by compounding

> set,t acl_m_h=100
variable m_h set
> set acl_m_foo=$acl_m_h\$
variable m_foo set
> check value: $acl_m_foo
check value: 100$
> test if tainted: ${run {$acl_m_foo}}
2026-05-12 01:48:25 Attempt to exec tainted path: '100$'
Failed: couldn't create child process: Operation not permitted

it feels like something has gone in sideways

Relevant log output
-------------------

No response

---
View it on Exim Forgejo ( https://code.exim.org/exim/exim/issues/3224 ) or reply to this email directly.