Regard command-line recipients as tainted

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index f9e39d2dc09f2f8bd9e03a7bca003b693021da38..f10e45ceefb5d844d340392e22ca4fd21576630c 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -22,6 +22,8 @@ JH/04 Support CHUNKING from an smtp transport using a transport_filter, when
       DKIM signing is being done.  Previously a transport_filter would always
       disable CHUNKING, falling back to traditional DATA.
 
       DKIM signing is being done.  Previously a transport_filter would always
       disable CHUNKING, falling back to traditional DATA.
 

+JH/05 Regard command-line receipients as tainted.
+

 
 Exim version 4.93
 -----------------
 
 Exim version 4.93
 -----------------

diff --git a/src/src/exim.c b/src/src/exim.c
index d6952ef2ef665be4d482626982ce008a1a003fa1..a30e35bcab64fb038b26fae462c1d372084299be 100644 (file)
--- a/src/src/exim.c
+++ b/src/src/exim.c
@@ -4809,8 +4809,9 @@ if (verify_address_mode || f.address_test_mode)
     {
     while (recipients_arg < argc)
       {
     {
     while (recipients_arg < argc)
       {

-      uschar *s = argv[recipients_arg++];
-      while (*s != 0)
+      /* Supplied addresses are tainted since they come from a user */
+      uschar * s = string_copy_taint(argv[recipients_arg++], TRUE);
+      while (*s)

         {
         BOOL finished = FALSE;
         uschar *ss = parse_find_address_end(s, FALSE);
         {
         BOOL finished = FALSE;
         uschar *ss = parse_find_address_end(s, FALSE);


@@ -4818,16 +4819,16 @@ if (verify_address_mode || f.address_test_mode)
         test_address(s, flags, &exit_value);
         s = ss;
         if (!finished)
         test_address(s, flags, &exit_value);
         s = ss;
         if (!finished)

-          while (*(++s) != 0 && (*s == ',' || isspace(*s)));
+          while (*++s == ',' || isspace(*s)) ;

         }
       }
     }
 
   else for (;;)
     {
         }
       }
     }
 
   else for (;;)
     {

-    uschar *s = get_stdinput(NULL, NULL);
-    if (s == NULL) break;
-    test_address(s, flags, &exit_value);
+    uschar * s = get_stdinput(NULL, NULL);
+    if (!s) break;
+    test_address(string_copy_taint(s, TRUE), flags, &exit_value);

     }
 
   route_tidyup();
     }
 
   route_tidyup();


@@ -5321,13 +5322,13 @@ while (more)
 
     raw_sender = string_copy(sender_address);
 
 
     raw_sender = string_copy(sender_address);
 

-    /* Loop for each argument */
+    /* Loop for each argument (supplied by user hence tainted) */

 
     for (int i = 0; i < count; i++)
       {
       int start, end, domain;
 
     for (int i = 0; i < count; i++)
       {
       int start, end, domain;

-      uschar *errmess;
-      uschar *s = list[i];
+      uschar * errmess;
+      uschar * s = string_copy_taint(list[i], TRUE);

 
       /* Loop for each comma-separated address */
 
 
       /* Loop for each comma-separated address */