fetchmail-friends
[Top] [All Lists]

Re: [fetchmail] Possible security issue with %F

2003-04-02 15:14:48
On Wed, 02 Apr 2003, Robert de Bath wrote:

Your concerns apply to the envelope sender address (usually in
Return-Path), not to the From: address. Null from addresses are fine.

No. There is no 'Return-Path' header in this message; not sure why but
it isn't there.

Maybe the upstream server didn't write one and fetchmail fell back to
From.

This is good; it's actually possible to quote single quotes too; but
probably not worth the effort.

I'm aware you can expand the ' to '"'"' -- ugly ;-) I guess it wasn't
made because you'd have to expand the string, allocating memory, and
just exchanging it for _ is cheap -- no reallocation needed.

Where Email/procmail_all is the script name; the %F disappeared
completely _in the real world_.

Of course, it's a variable after all.

However, you should remove the single quotes from your mda string (DO
NOT WRITE mda "maildrop -f '%F'"!) because that's evil:

Hmm, This seems to fix the problem; should be safe too:

    mda "procmail -f %F'' Email/procmail_all"

Which version of procmail and fetchmail are you looking at? procmail
v3.15.1 (yes, obsolete) and fetchmail 6.2.2 are fine without the
trailing ''.

<Prev in Thread] Current Thread [Next in Thread>