Re: untainting alias file lookup

Am 27.10.2025 um 18:38 schrieb Andreas Metzler via Exim-users:
> On 2025-10-27 Paul Muster via Exim-users <[email protected]> wrote:

>>   data = ${lookup{$local_part_data}lsearch*${lookup{$domain}
>> dsearch,ret=full,filter=file {CONFDIR/aliases/}}}

> You are changing the wrong thing. exim is perfectly fine with looking up
> an arbitrary tainted string ($local_part), it does not like using using a
> tainted string ($domain) directly as filename.
> 
> You will probably be fine if you use $domain_data instead of $domain.

Yes, indeed.

> (With "domains = dsearch; CONFDIR/aliases" you could get rid of the
> CONFDIR/localdomains file)

Yes, nice side effect.

Thanks & Regards,

Paul

-- 
## subscription configuration (requires account):
##   https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
##   [email protected]
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/