Re: Using a dsearch lookup to untaint data

I think you are not actually inspecting and understanding these debug
outputs yourself:


On 2025/12/19 8:59 PM, Johnnie Adams via Exim-users wrote:
> Thanks! Here's the new result for a bracketed period:
> 
> 853220  ╭considering: ${lookup {${local_part}.list}
> dsearch,ret=key,filter=file {/opt/lsoft/listserv/home} {${sg
> {$value}{[.]list}{}}}fail}

> 853220   ├──expanding: ${local_part}.list
> 
> 853220   ╰─────result: owner-johnnies-test-list-2.list

> 853220  lookup failed



> Here's the result for a singly escaped period:
> 
> 853256  ╭considering: ${lookup {${local_part}.list}
> dsearch,ret=key,filter=file {/opt/lsoft/listserv/home} {${sg
> {$value}{.list}{}}}fail}

> 853256   ├──expanding: ${local_part}.list
> 
> 853256   ╰─────result: johnnies-test-list-2.list

> 853256  ╰─────result: johnnies-test-2

>  while the
> bracketed period gives the right result and panics the application.

The keys for the two lookups differ.  And, not unexpectedly, the results differ.

It writes to the panic log because that is what your sg expansion asks
it to do when there is no match.
-- 
Cheers,
   Jeremy

-- 
## subscription configuration (requires account):
##   https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
##   [email protected]
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/