diff options
| -rw-r--r-- | src/src/directory.c | 5 | ||||
| -rw-r--r-- | src/src/spool_out.c | 3 |
2 files changed, 7 insertions, 1 deletions
diff --git a/src/src/directory.c b/src/src/directory.c index 2d4d565f4..f54a781b7 100644 --- a/src/src/directory.c +++ b/src/src/directory.c @@ -44,6 +44,9 @@ uschar c = 1; struct stat statbuf; uschar * path; +if (is_tainted(name)) + { p = US"create"; path = US name; errno = ERRNO_TAINT; goto bad; } + if (parent) { path = string_sprintf("%s%s%s", parent, US"/", name); @@ -85,7 +88,7 @@ return TRUE; bad: if (panic) log_write(0, LOG_MAIN|LOG_PANIC_DIE, - "Failed to %s directory \"%s\": %s\n", p, path, strerror(errno)); + "Failed to %s directory \"%s\": %s\n", p, path, exim_errstr(errno)); return FALSE; } diff --git a/src/src/spool_out.c b/src/src/spool_out.c index 9a514b331..4539e3c69 100644 --- a/src/src/spool_out.c +++ b/src/src/spool_out.c @@ -505,6 +505,9 @@ spool_move_message(uschar *id, uschar *subdir, uschar *from, uschar *to) { uschar * dest_qname = queue_name_dest ? queue_name_dest : queue_name; +/* Since we are working within the spool, de-taint the dest queue name */ +dest_qname = string_copy_taint(dest_qname, FALSE); + /* Create any output directories that do not exist. */ (void) directory_make(spool_directory, |