Mailing List Archive: 4.96 -> 4.96: 'tainted search query is not properly quoted'

4.96 -> 4.96: 'tainted search query is not properly quoted'

Jun 12, 2023, 11:51 PM

Post #1 of 4 (191 views)

Hi all,

Since upgrading, I'm getting tons of errors like that:
- - -
tainted search query is not properly quoted (ACL require, /usr/local/etc/exim/configure 177): SELECT mail_id, do_accept, do_defer, do_deny, error_message, debug_message, score FROM record_RCPT('chaos1.de', 'axel.rau', 'FreeBSD.org', 'freebsd-bugs+bounces-13310-axel.rau=chaos1.de', 33208948, 26, 'false', 'true', 'true', 0, '', '', 62225728)
- - -
config:
- - -
require set acl_m_tmp = ${lookup pgsql {SELECT mail_id, do_accept, do_defer, do_deny, error_message, debug_message, score \
FROM record_RCPT(\
'${quote_pgsql:$acl_m_recipient_domain}', '${lc:$acl_m_recipient_localpart}', \
'${quote_pgsql:$sender_address_domain}', '${lc:$sender_address_local_part}', \
$acl_c_rhost_id, $acl_c_net_domain_id, 'false', \
'$acl_m_OK_RVHL', '$acl_m_OK_RDNS', $acl_m_gdl_score, '${quote_pgsql:$acl_m_gdl_logtext}', \
'$acl_m_gdl_INSERTtext', $acl_c_event_id)}}

- - -
Any help appreciated.

Thanks, Axel
---
PGP-Key: CDE74120 ? mobile: +49 160 7568212
computing @ chaos claudius

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

Re: 4.96 -> 4.96: 'tainted search query is not properly quoted' [ In reply to ]

exim-users at lists

Jun 13, 2023, 1:11 AM

Post #2 of 4 (191 views)

Permalink

> Am 13.06.2023 um 08:51 schrieb Axel Rau via Exim-users <exim-users@lists.exim.org>:
>
> tainted search query is not properly
I’m reading in the spec p 79:
"If tainted data is used in the query then it should be quuted by using the ${quote_<lookup- type>:<string>} expansion operator appropriate for the lookup.“

What takes exim as „tained data“ ?

Axel
---
PGP-Key: CDE74120 ? mobile: +49 160 7568212
computing @ chaos claudius

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

Re: 4.96 -> 4.96: 'tainted search query is not properly quoted' [ In reply to ]

exim-users at lists

Jun 13, 2023, 1:26 AM

Post #3 of 4 (191 views)

Permalink

Hi!

> > Am 13.06.2023 um 08:51 schrieb Axel Rau via Exim-users <exim-users@lists.exim.org>:

> > tainted search query is not properly
> I???m reading in the spec p 79:
> "If tainted data is used in the query then it should be quuted by using the ${quote_<lookup- type>:<string>} expansion operator appropriate for the lookup.???
>
> What takes exim as 'tained data' ?

Similar to perl: That which is user/network-supplied.

--
pi@opsec.eu +49 171 3101372 Now what ?

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

Re: 4.96 -> 4.96: 'tainted search query is not properly quoted' [ In reply to ]

exim-users at lists

Jun 13, 2023, 11:01 AM

Post #4 of 4 (191 views)

Permalink

> Am 13.06.2023 um 10:26 schrieb Kurt Jaeger via Exim-users <exim-users@lists.exim.org>:
>
>> What takes exim as 'tained data' ?
>
> Similar to perl: That which is user/network-supplied.
My guess: I’m quoting exim variables derived from external data, not my own variables.

Thanks for responding,
Axel
---
PGP-Key: CDE74120 ? mobile: +49 160 7568212
computing @ chaos claudius

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/