SECURITY: Fix safeguard against upward traversal in msglog files.
authorHeiko Schlittermann (HS12-RIPE) <hs@schlittermann.de>
Sat, 21 Nov 2020 21:41:28 +0000 (22:41 +0100)
committerHeiko Schlittermann (HS12-RIPE) <hs@schlittermann.de>
Thu, 27 May 2021 19:30:36 +0000 (21:30 +0200)
commit40b8be2e25abb7569a05c839f5d0ab6176307a75
treefa8567f5f752845ef0e7639a8556cc1cc0e5e29e
parent5dad84609e49ce4c45d29ccb98b1b7b1f296d69e
SECURITY: Fix safeguard against upward traversal in msglog files.

Credits: Qualys

    3/ In src/deliver.c:

     333 static int
     334 open_msglog_file(uschar *filename, int mode, uschar **error)
     335 {
     336 if (Ustrstr(filename, US"/../"))
     337   log_write(0, LOG_MAIN|LOG_PANIC,
     338     "Attempt to open msglog file path with upward-traversal: '%s'\n", filename);

    Should this be LOG_PANIC_DIE instead of LOG_PANIC? Right now it will log
    the /../ attempt but will open the file anyway.

(cherry picked from commit 742c27f02d83792937dcb1719b380d3dde6228bf)
(cherry picked from commit 1e9a340c05d7233969637095a8a6378b14de2976)
doc/doc-txt/ChangeLog
src/src/deliver.c