Re: exim4 untainting and mailman does not work

On Mon, Oct 27, 2025 at 8:48 AM Marc MERLIN via Exim-users <
[email protected]> wrote:

> So, I finally did the exim4 upgrade that brought tainting and has now
> broken my mailman config.
>
> I understand why tainting and the basics, but in the case of the mailman
> transport I wrote 20+ years ago, it is safe and I'd like to untaint
> local_part.
>
> Note that require_files encsures that local_part can't be random crap
> or the filematch would fail and the transport would never be called.
> Still, I tried to untaint with address_data and pass it to transport,
> but it's still tainted
>
> I lost 6H on this upgrade today and I'm now down until I downgrade exim
> and pin it back to an old version I'll never upgrade again.
> Before I go there, is there a fix to
> 22:29:56 1895290   ** [email protected] F=<[email protected]>
> R=mm21_main_director T=mm21_transport: Tainted arg 2 for mm21_transport
> transport command: 'testlist'
> ?
>
> What I have is:
> .ifdef MAILMAN_HOME
> # We want this router first in case we have a list named something like
> # mailman-owner
> mm21_main_director:
>   debug_print = "R: mm21_main_director for $local_part@$domain"
>   driver = accept
>   # Explicitly untaint by capturing the validated local_part
>   address_data = ${sg{${lc:$local_part}}{^([a-zA-Z0-9_.-]+)\$}{\$1}}
>   # Condition to validate $local_part against safe characters and untaint
> it
>   # We'll allow listname+foo addressing, but not for other admin addresses
>   local_part_suffix = +*
>   local_part_suffix_optional
>   require_files = MAILMAN_HOME/lists/${lc::$local_part}/config.pck
>   transport = mm21_transport
>
> mm21_director:
>   debug_print = "R: mm21_director for $local_part@$domain"
>   driver = accept
>   # Explicitly untaint by capturing the validated local_part
>   address_data = ${sg{${lc:$local_part}}{^([a-zA-Z0-9_.-]+)\$}{\$1}}
>   require_files = MAILMAN_HOME/lists/${lc::$local_part}/config.pck
>   address_data = ${sg{${lc:$local_part}}{^([a-zA-Z0-9_.-]+)\$}{\$1}}
>   transport = mm21_transport
> .endif
>
>
> mm21_transport:
>   debug_print = "T: mm21_transport for $local_part@$domain"
>   driver = pipe
>   # In case you wonder, substr_2 removes the leading '-'
>   # and the regex removes optional +foo=hostname that can be after -bounce
>   # (if you use VERP) -- Marc
>   command = MAILMAN_WRAP "${if
> def:local_part_suffix{${substr_2:{${sg{${lc:$local_part_suffix}}{\\\\\+.*}{}}}}{post}}"
> ${lc:$address_data}
>   current_directory = MAILMAN_HOME
>   home_directory = MAILMAN_HOME
>   user = MAILMAN_UID
>   group = MAILMAN_GID
> .endif
>

Hello Marc,

Long time!

Here are my MM21 bits (which I commented out when I moved to MM3).
I had no issues with Exim 4.9x:

MACROS:
MAILMAN_HOME=/usr/local/mailman2
MAILMAN_WRAP=MAILMAN_HOME/mail/mailman
MAILMAN_USER=mailman
MAILMAN_GROUP=Debian-exim


mailman_router:
  driver                 = accept
  local_parts         = dsearch,filter=dir;MAILMAN_HOME/lists
  require_files       = MAILMAN_HOME/lists/$local_part_data/config.pck
  local_part_suffix = -bounces : -bounces+* : \
                               -confirm+* : -join : -leave : \
                              -owner : -request : -admin
  local_part_suffix_optional
  domains           = +mm_domains
  transport          = mailman_transport

mailman_transport:
  driver             = pipe
  command      = MAILMAN_WRAP \
                         '${if def:local_part_suffix \
                         {${sg{$local_part_suffix}{-(\\w+)(\\+.*)?}{\$1}}} \
                         {post}}' \
                         ${lc:$local_part_data}
  current_directory = MAILMAN_HOME
  home_directory    = MAILMAN_HOME
  user                     = MAILMAN_USER
  group                   = MAILMAN_GROUP



PS: Also, If you need any help moving to Mailman3, just hola :)

Adiós

-- 
Best regards,
Odhiambo WASHINGTON,
Nairobi,KE
+254 7 3200 0004/+254 7 2274 3223
 In an Internet failure case, the #1 suspect is a constant: DNS.
"Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-)
[How to ask smart questions:
http://www.catb.org/~esr/faqs/smart-questions.html]

-- 
## subscription configuration (requires account):
##   https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
##   [email protected]
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/