Untaint $local_part, $domain and other variables

Hello


I'm seeking assistance with passing sanitized variables to a script at the transport level. Specifically, I need to pass $local_part@$domain, $sender_address, $sender_host_address, and $sender_address_domain to the script.


Here is the transport configuration I'm using:


spf_fail_notif:
   driver = pipe
   command = "/etc/exim4/reject_notif.sh \

   ${quote:$local_part@$domain} \
       ${quote:$sender_address} \
       ${quote:$sender_host_address} \
       ${quote:$sender_address_domain}
   user = vmail
   group = vmail
   return_output = false


I'm trying to implement a mechanism to notify a local recipient when a message addressed to them is denied by an ACL rule—for example, due to an SPF permerror, an SPF fail, malware, or a prohibited file attachment.


I've already tried using ${quote:} ${eval:} and ${escape:}, but the variables continues being tainted.

Thanks in advance for any help!


Emilio Augusto Lazo Zaia

-- 
## subscription configuration (requires account):
##   https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
##   [email protected]
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/