In message <199405172140.OAA05837@mycroft.GreatCircle.COM>, Brent Chapman
writes:
> "John P. Rouillard" <rouilj@terminus.cs.umb.edu> writes:
>
> # The problem is that there is no great way to handle it. I know of one
> # vendor sendmail that will happily try to write to a file of that
> # name. Sendmail 8.6 on the otherhand won't attempt to treat it as a
> # file since it has an @ in it. I think the best we can do is something
> # like:
> #
> #
> # if there is a / at the front of the address,
> #
> # split the address on /
> #
> # does the first component of the address exist, if so bounce
> # the address. (Anybody who has a subdirectory of / wit
> h
> # an = sign in the name should lose.)
> #
> # if the first component doesn't exist, accept the address.
>
> Not all of them begin with "/".
Are you sure, every X.400 address (mapped into internet space) I've
seen starts with a "/". I think the / is an introducer (wrong term I
know) to the address space. As I remember, the inital '/' was required
according to the RFC that defines mapping from X.400 to Internet
addresses. Does anybody out ther have the RFC and can check/verify
this assumption of mine.
I know of no sendmail that will use:
test: tmp/foo
as a file. All sendmails I have seen (BSD 4.2, SunOS, IDA, King James,
8.6) check for a fully specified filename, i.e. one with a "/" at the
front, but I can belive such a dain-bramage sendmail exists. Maybe the
check should be rewritten to include:
if there is no / at the front, but there are internal /'s
bounce the address.
> I'd suggest adding a flag to make the whole "Hostile address" check
> optional (but leave it enabled by default).
Well, this is something that should not be left to the discresion of
the list administrator. It should be under the sole control of the
majordomo admin. If the majordomo admin wants to allow it, s/he can
modify the valid_addr function directly and remove the '/' check,
right?
-- John
John Rouillard
Special Projects Volunteer University of Massachusetts at Boston
rouilj@cs.umb.edu (preferred) Boston, MA, (617) 287-6480
==============================================================================
My employers don't acknowledge my existence much less my opinions.
Follow-Ups:
References:
|
|
