blob: 70a460e242bd07fb07c36753ca704a0b89737c11 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
|
# Exim test configuration 2620
PARTIAL=localhost::PORT_N
SERVERS=PARTIAL/test/CALLER/
.include DIR/aux-var/std_conf_prefix
primary_hostname = myhost.test.ex
# ----- Main settings -----
domainlist local_domains = @
hostlist relay_hosts = net-pgsql;select * from them where \
id='$sender_host_address'
acl_smtp_rcpt = check_recipient
pgsql_servers = SERVERS
# ----- ACL -----
begin acl
check_recipient:
# Tainted-data checks
warn
# taint only in lookup string, properly quoted
set acl_m0 = ok: ${lookup pgsql {select name from them where id = '${quote_pgsql:$local_part}'}}
# taint only in lookup string, but not quoted
set acl_m0 = FAIL: ${lookup pgsql,cache=no_rd {select name from them where id = '$local_part'}}
warn
# option on lookup type unaffected
set acl_m0 = ok: ${lookup pgsql,servers=SERVERS {select name from them where id = '${quote_pgsql:$local_part}'}}
# partial server-spec, indexing main-option, works
set acl_m0 = ok: ${lookup pgsql,servers=PARTIAL {select name from them where id = '${quote_pgsql:$local_part}'}}
# oldstyle server spec, prepended to lookup string, fails with taint
set acl_m0 = FAIL: ${lookup pgsql {servers=SERVERS; select name from them where id = '${quote_pgsql:$local_part}'}}
# In list-style lookup, tainted lookup string is ok if server spec comes from main-option
warn set acl_m0 = ok: hostlist
hosts = net-pgsql;select * from them where id='${quote_pgsql:$local_part}'
# ... but setting a per-query servers spec fails due to the taint
warn set acl_m0 = FAIL: hostlist
hosts = <& net-pgsql;servers=SERVERS; select * from them where id='${quote_pgsql:$local_part}'
# The newer server-list-as-option-to-lookup-type is not a solution to tainted data in the lookup, because
# string-expansion is done before list-expansion so the taint contaminates the entire list.
warn set acl_m0 = FAIL: hostlist
hosts = <& net-pgsql,servers=SERVERS; select * from them where id='${quote_pgsql:$local_part}'
accept domains = +local_domains
accept hosts = +relay_hosts
deny message = relay not permitted
# ----- Routers -----
begin routers
r1:
driver = accept
address_data = ${lookup pgsql{select name from them where id='ph10'}}
transport = t1
# ----- Transports -----
begin transports
t1:
driver = appendfile
file = DIR/test-mail/\
${lookup pgsql{select id from them where id='ph10'}{$value}fail}
user = CALLER
# End
|
