From c1faf04b865465894c7ca41ab4585fb69d4a5936 Mon Sep 17 00:00:00 2001 From: Jeremy Harris Date: Wed, 12 May 2021 15:01:12 +0100 Subject: [PATCH 3/3] Named Queues: fix immediate-delivery. Bug 2743 (cherry picked from commit 159cf206c97f876b07829d92db2217689745c1e8) --- doc/ChangeLog | 4 ++++ src/exim.c | 6 ++++-- test/confs/0576 | 6 ++++++ test/log/0576 | 3 +++ test/scripts/0000-Basic/0576 | 4 ++++ 5 files changed, 21 insertions(+), 2 deletions(-) diff --git a/doc/ChangeLog b/doc/ChangeLog index 9f104b4e6..e60c1cad5 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -223,6 +223,10 @@ QS/04 Always die if requested from internal logging, even is logging is JH/52 Fix ${ip6norm:} operator. Previously, any trailing line text was dropped, making it unusable in complex expressions. +JH/53 Bug 2743: fix immediate-delivery via named queue. Previously this would + fail with a taint-check on the spoolfile name, and leave the message + queued. + Exim version 4.94 ----------------- diff --git a/src/exim.c b/src/exim.c index ee75739ec..7411f0467 100644 --- a/src/exim.c +++ b/src/exim.c @@ -2789,9 +2789,11 @@ on the second character (the one after '-'), to save some effort. */ else badarg = TRUE; break; - /* -MCG: set the queue name, to a non-default value */ + /* -MCG: set the queue name, to a non-default value. Arguably, anything + from the commandline should be tainted - but we will need an untainted + value for the spoolfile when doing a -odi delivery process. */ - case 'G': if (++i < argc) queue_name = string_copy_taint(exim_str_fail_toolong(argv[i], EXIM_DRIVERNAME_MAX, "-MCG"), TRUE); + case 'G': if (++i < argc) queue_name = string_copy_taint(exim_str_fail_toolong(argv[i], EXIM_DRIVERNAME_MAX, "-MCG"), FALSE); else badarg = TRUE; break; -- 2.30.2