[Bug 8401] Redirectors plugin incorrectly promotes arbitrary query parameter values into hostnames for URIDNSBL lookups

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=3D8401

Kent Oyer <[email protected]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[email protected]

--- Comment #2 from Kent Oyer <[email protected]> ---
I was able to reproduce it on my system and released a fix in release 19356=
71.

If you're not running on trunk and don't want to wait for the next version
release, you can work around it by putting this in your config:

url_redirector_params=20
(?:adurl|af_web_dp|cm_destination|continue|destination|destURL|goto|h|l|log=
in|location|p1|pval|r|redir|redirect|redirectTo|ret_url|return|returnUrl|re=
ferer|service|target|tid|u|url)=3D((?:https?(?::|%3[Aa]))[^&]+)


This regex requires embedded URIs to start with "http" which has a downside
that  schemeless URIs won't be detected, but avoids the issue with FPs.

--=20
You are receiving this mail because:
You are the assignee for the bug.=