Docs: more info on taint

[exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 1b024f8f54b6d1b10ad7dade430795b71f8ff9c2..ccfa4424af467d75b478db3fc4a67a06218c45d5 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -8061,8 +8061,8 @@ For MySQL, PostgreSQL and Redis lookups (but not currently for Oracle and InterB
 it is possible to specify a list of servers with an individual query. This is
 done by appending a comma-separated option to the query type:
 .display
-.endd
 &`,servers=`&&'server1:server2:server3:...'&
+.endd
 Each item in the list may take one of two forms:
 .olist
 If it contains no slashes it is assumed to be just a host name. The appropriate
@@ -8096,7 +8096,7 @@ option, you can still update it by a query of this form:
 ${lookup pgsql,servers=master/db/name/pw {UPDATE ...} }
 .endd
 
-An older syntax places the servers speciification before the qury,
+An older syntax places the servers specification before the query,
 semicolon separated:
 .code
 ${lookup mysql{servers=master; UPDATE ...} }
@@ -9453,10 +9453,22 @@ the data type.  ACL rules always expand strings.  A couple of expansion
 conditions do not expand some of the brace-delimited branches, for security
 reasons,
 .cindex "tainted data" expansion
+.cindex "tainted data" definition
 .cindex expansion "tainted data"
 and expansion of data deriving from the sender (&"tainted data"&)
 is not permitted.
 
+.new
+Common ways of obtaining untainted equivalents of variables with
+tainted values
+.cindex "tainted data" "de-tainting"
+come down to using the tainted value as a lookup key in a trusted database.
+This database could be the filestem structure,
+or the password file,
+or accessed via a DBMS.
+Specific methods are indexed under &"de-tainting"&.
+.wen
+
 
 
 .section "Literal text in expanded strings" "SECTlittext"
@@ -10169,9 +10181,9 @@ You can use &`fail`& instead of {<&'string3'&>} as in a string extract.
 
 
 .new
-.vitem &*${listquote{*&<&'separator'&>&*}{*&<&'string'&>&*}}*"
-.citem quoting "for list"
-.citem list quoting
+.vitem &*${listquote{*&<&'separator'&>&*}{*&<&'string'&>&*}}*&
+.cindex quoting "for list"
+.cindex list quoting
 This item doubles any occurrence of the separator character
 in the given string.
 An empty string is replaced with a single space.