untainting alias file lookup

Hi there,

also upgraded to Debian 12 Bookworm with Exim 4.94 and got in touch with 
tainting. With "allow_insecure_tainted_data = yes" I'm just getting 
warnings while mail delivery still works properly. :-)

So I'm going to *use* this new feature starting with the alias file lookup:

virtual:
   driver = redirect
   allow_defer
   allow_fail
   data = ${lookup{$local_part}lsearch*{CONFDIR/aliases/$domain}}
   domains = lsearch;CONFDIR/localdomains
   no_more
   qualify_preserve_domain
   retry_use_local_part

There are files in CONFDIR/aliases/ with the domain name as file name. 
These files contain lists of
localpart: [email protected]
(as alias files do).

As far as I understand I need to replace

   data = ${lookup{$local_part}lsearch*{CONFDIR/aliases/$domain}}

My first attempt is now:

  data = ${lookup{$local_part_data}lsearch*${lookup{$domain} 
dsearch,ret=full,filter=file {CONFDIR/aliases/}}}
But I'm ending up with

message: failed to expand 
"${lookup{$local_part_data}lsearch*${lookup{$domain} 
dsearch,ret=full,filter=file {/etc/exim4/aliases/}}}": failed to open 
lookup{<domain> for linear search: No such file or directory
<user>@<domain> cannot be resolved at this time: failed to expand 
"${lookup{$local_part_data}lsearch*${lookup{$domain} 
dsearch,ret=full,filter=file {/etc/exim4/aliases/}}}": failed to open 
lookup{<domain> for linear search: No such file or directory

Well, I'm a little bit lost. What to do?


Thanks & kind Regards,

Paul

-- 
## subscription configuration (requires account):
##   https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
##   [email protected]
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/