Re: Hook in external programs

On 2013–01–22 Sam Varshavchik wrote:

> There are a number of ways to invoke an external program. The cc
> command, for example, can run an external program and pipe it the
> entire message on standard input. Alternatively, the backticks also
> execute an external program, but without piping the message to it.
> If the result of the backticks expression is not assigned anywhere,
> the output of the external program gets basically thrown away.

Thanks. I tried this before, but it did not work. The reason is
probable that maildrop passes a minimal environment to the command
which does not include the necessary variables for notify-send to
work (DBUS maybe??). A simple test with `touch somefile` works
perfectly.

> However, before doing so, it is necessary to fully understanding
> exactly how the process works. Since the shell gets used to execute
> an external program, and the various bits and pieces you're
> extracting from a message come from untrusted sources, until there
> is full and complete understanding of shell quoting rules, it's
> quite easy to create an exploitable situation that a hostile
> attacker can take advantage of.
> 
> Let's say, for example, you intend to extract the subject line of
> the message, put it in $SUBJECT, and pass it as a parameter to your
> external program. The naive approach would be something like this,
> in .maildropfilter:
> 
> `notify-send -s "$SUBJECT"`
> 
> Well, guess what happens if someone sends you the following message:
> 
> Subject: "; rm -rf $HOME # You're 0wned!
> 
> So, for doing this kind of an automated mail processing, you really
> need to have a pretty good grasp of information security.

Thanks for the warning about the exploitability. I would simply
delete all characters which are not within a-zA-Z. That means it
will mangle messages with Unicode characters, but honestly, I don't
care. If you see a problem with that, please let me know; then I
will fall back to a static string without parsing the messages.

Marco

------------------------------------------------------------------------------
Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
MVPs and experts. ON SALE this month only -- learn more at:
http://p.sf.net/sfu/learnnow-d2d

_______________________________________________
Courier-maildrop mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/courier-maildrop

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQEcBAEBAgAGBQJRABExAAoJEPGqVaNSn0iKLPkIALAT28eyAYtGJrGBeEBwZBCB
ZVBpWDKY/AwhLPAvDFZnwrogj5eauvY9cnNcZDc36s6vqwnXi+FQ5Kb2LxeSs/VO
+Le0i055kYLWQhS/2oRiX8OHftVLjeUfemuSHHu5dZky6RAT/9mFphncf0k/QwwV
Drun/gRWBcLw2BJVaAqU8xq4wGaeJzkuGSRGMW3mCmjM2XbzhPD+rf9Bb80AzAJ3
I79nwxc95vR/oZUUszYNePmJzsX/8XwEMTTfNVHfPuH502R106tbJLGtoMjyvFD2
XAuZlrDQvQInf8g6DFd2e3vZ1N5kHa2EeWBRawS42xu4aoS9H11DmBsNUIkOLKo=
=Z+cW
-----END PGP SIGNATURE-----