Mailing List Archive

Tainted search query is not properly quoted
I am missing a little something in my config for greylisting.
Exim-4.96 here.

2023-03-19 13:53:21 1pdqf6-000LgR-0z tainted search query is not properly
quoted (ACL warn, /etc/exim/exim-greylist.conf.inc 124): INSERT INTO
greylist VALUES ( 'ecpeUlXRs7cHPrkaiW5j', '1679223501', '74.6.132.40', '
sonic306-1.consmr.mail.bf2.yahoo.com' );

The relevant config causing this:

warn condition = ${if eq {$acl_m_greyexpiry}{} {1}}
set acl_m_dontcare = ${lookup sqlite {INSERT INTO greylist \
VALUES ( '$acl_m_greyident', \

'${eval10:$tod_epoch+300}', \

'${quote_sqlite:$sender_host_address}', \

'${quote_sqlite:$sender_helo_name}' );}}


It's not obvious to me what I haven't quoted properly.


--
Best regards,
Odhiambo WASHINGTON,
Nairobi,KE
+254 7 3200 0004/+254 7 2274 3223
"Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(?)_/¯ :-)
--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
Re: Tainted search query is not properly quoted [ In reply to ]
On 19/03/2023 10:58, Odhiambo Washington via Exim-users wrote:
> warn condition = ${if eq {$acl_m_greyexpiry}{} {1}}
> set acl_m_dontcare = ${lookup sqlite {INSERT INTO greylist \
> VALUES ( '$acl_m_greyident', \
>
> '${eval10:$tod_epoch+300}', \
>
> '${quote_sqlite:$sender_host_address}', \
>
> '${quote_sqlite:$sender_helo_name}' );}}
>
>
> It's not obvious to me what I haven't quoted properly.

The only obvious element is your $acl_m_greyindent, since $tod_epoch
shouldn't be derived from wire information. The debug "expand" channel
would show you for definite.
--
Cheers,
Jeremy


--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
Re: Tainted search query is not properly quoted [ In reply to ]
On Sun, Mar 19, 2023 at 2:31?PM Jeremy Harris via Exim-users <
exim-users@exim.org> wrote:

> On 19/03/2023 10:58, Odhiambo Washington via Exim-users wrote:
> > warn condition = ${if eq {$acl_m_greyexpiry}{} {1}}
> > set acl_m_dontcare = ${lookup sqlite {INSERT INTO greylist \
> > VALUES ( '$acl_m_greyident', \
> >
> > '${eval10:$tod_epoch+300}', \
> >
> > '${quote_sqlite:$sender_host_address}', \
> >
> > '${quote_sqlite:$sender_helo_name}' );}}
> >
> >
> > It's not obvious to me what I haven't quoted properly.
>
> The only obvious element is your $acl_m_greyindent, since $tod_epoch
> shouldn't be derived from wire information. The debug "expand" channel
> would show you for definite.
>

That comes from this:

# Generate a hashed 'identity' for the mail, as described above.
warn set acl_m_greyident =
${hash{20}{62}{$sender_address$recipients$h_message-id:}}

What mod do I need to make on it?

Thanks

--
Best regards,
Odhiambo WASHINGTON,
Nairobi,KE
+254 7 3200 0004/+254 7 2274 3223
"Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(?)_/¯ :-)
--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
Re: Tainted search query is not properly quoted [ In reply to ]
On 20/03/2023 15:14, Odhiambo Washington via Exim-users wrote:
> What mod do I need to make on it?

Quote it. Like you already are for $sender_helo_name.
--
Cheers,
Jeremy


--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
Re: Tainted search query is not properly quoted [ In reply to ]
On Mon, Mar 20, 2023 at 7:27?PM Jeremy Harris via Exim-users <
exim-users@exim.org> wrote:

> On 20/03/2023 15:14, Odhiambo Washington via Exim-users wrote:
> > What mod do I need to make on it?
>
> Quote it. Like you already are for $sender_helo_name.
> --
> Cheers,
> Jeremy
>

That has now eliminated the error.

Thank you.


--
Best regards,
Odhiambo WASHINGTON,
Nairobi,KE
+254 7 3200 0004/+254 7 2274 3223
"Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(?)_/¯ :-)
--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
Tainted search query is not properly quoted [ In reply to ]
On Sun, 19 Mar 2023, 23:00 , Odhiambo Washington <odhiambo@gmail.com>
wrote:

> set acl_m_dontcare = ${lookup sqlite {INSERT INTO greylist \
> VALUES ( '$acl_m_greyident', \
> '${eval10:$tod_epoch+300}', \
> '${quote_sqlite:$sender_host_address}', \
> '${quote_sqlite:$sender_helo_name}' );}}
>

It's not obvious to me what I haven't quoted properly.
>

In addition to the ineffective quoting of $acl_m_greyident (which Jeremy
mentioned), the second column should be a number or timestamp rather than a
varchar, so adding quotes around ${eval10:$tod_epoch+300} is backwards.

If you habitually add quotes to all columns to "make them safe", then
you're lulling yourself into a false sense of security; see
https://bobby-tables.com/ for why this is a bad habit.

Also, although most SQL engines will tolerate strings when expecting other
types of values, sometimes the automatic conversions don't do what one
might expect. In particular, sometimes numbers are treated as (a)
unix-epoch seconds, sometimes they're treated as (b) julian days or (c)
modified julian days, and sometimes they're converted to a string and then
read back as (d) YYYYMMDDHHMMSS. Some try option (d), and then if that
doesn't work, switch to one of the others.

-Martin

PS: personally I would be inclined to use the clock in the database and
write the expression as datetime('now', '+5 minutes') or
unixepoch('now','+5 minutes') (depending on whether you want to store a
number or a datetime in that column)

>
--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/