From 5005b0d39ef234f834c5dc4d42c1567d67141d8f Mon Sep 17 00:00:00 2001 From: Jeremy Harris Date: Wed, 7 Jul 2021 22:19:07 +0100 Subject: Fix tainted message for fakereject (cherry picked from commit a9ac2d7fc219e41a353abf1f599258b9b9d21b7e) --- doc/doc-txt/ChangeLog | 4 ++++ src/src/acl.c | 4 +++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog index e60c1cad5..3e93f653f 100644 --- a/doc/doc-txt/ChangeLog +++ b/doc/doc-txt/ChangeLog @@ -227,6 +227,10 @@ JH/53 Bug 2743: fix immediate-delivery via named queue. Previously this would fail with a taint-check on the spoolfile name, and leave the message queued. +JH/57 Fix control=fakreject for a custom message containing tainted data. + Previously this resulted in a log complaint, due to a re-expansion present + since fakereject was originally introduced. + Exim version 4.94 ----------------- diff --git a/src/src/acl.c b/src/src/acl.c index 7061230b4..65324405c 100644 --- a/src/src/acl.c +++ b/src/src/acl.c @@ -3137,7 +3137,9 @@ for (; cb; cb = cb->next) { const uschar *pp = p + 1; while (*pp) pp++; - fake_response_text = expand_string(string_copyn(p+1, pp-p-1)); + /* The entire control= line was expanded at top so no need to expand + the part after the / */ + fake_response_text = string_copyn(p+1, pp-p-1); p = pp; } else /* Explicitly reset to default string */ -- cgit v1.2.1