I'm upgrading an exim4 installation which has some custom filters, to Debian 11. (Specifically, the filters are this.)
Since that uses Exim 4.94, I've now run into the new-ish "tainted variables" feature, which has broken my filter. Checking Exim in debug mode with exim4 -bdf -d+filter
the error is referring to a tainted filename (some linebreaks added for readability):
102536 LOG: MAIN PANIC
102536 Tainted filename for search '/var/spool/exim4/db/disposable-aliases.db'
102536 Filter error: failed to expand
"${lookup sqlite{/var/spool/exim4/db/disposable-aliases.db \
select default_remaining from stem_configs \
where stem = '${quote_sqlite:$local_part}'} {$value}{0}}"
in add command: NULL
102536 Filter: end of processing
In this case, the reference to a filename seems to be spurious, as firstly the filename is hard-wired (so can't be tainted?) and secondly, if I replace the '${quote_sqlite:$local_part}'
portion of the query with a literal value, the error stops (at least from this particular lookup).
My suspicion therefore is that it's actually the presence of $local_part
in the query which is the problem, and not the filename.
I have discovered there's an untainted version of $local_part
available in some circumstances, $local_part_data
- however in my circumstance, it isn't being set and so isn't useful.
More searching finds this assertion in the Exim4 documentation here:
If tainted data is used in the query then it should be quuted [sic] by using the ${quote_:} expansion operator appropriate for the lookup.
This seems to imply that the ${sqlite_quote: .. }
expansion should be de-tainting the content of $local_data
. That would seem sensible, but is this actually correct, given that if I replace the expansion with a literal the tainting problem stops?
If ${sqlite_quote: .. }
really is de-tainting its result, then what is causing this look-up to be rejected?
If it is not, then what other recourse do I have? The sqlite look-up above is actually designed to validate the local part against a list of valid values stored in the database, and should be able to de-taint the value!
I should add: I can't use a file lookup, because this valid list needs to be configured dynamicially, outside of exim4 configuration files.