| This information is originally from http://www.ijs.si/software/amavisd/ |
| (Thanks to amavisd-new, Mark Martinec, and Vivek Khera!) |
| |
| If SpamAssassin is running in taint-mode (the default) and is configured to |
| call Vipul's Razor 2.22 or higher, then Razor2 checks will fail because the |
| Razor2 code is not quite taint-safe. The problem is still present in 2.36 |
| and the SpamAssassin developers do not know when or how this will be |
| addressed so please don't ask us! |
| |
| To apply: cd to the directory /usr/{lib,share}/perl5/.../Razor2 (wherever |
| the Client subdirectory is located) and apply the patch directly with: |
| |
| patch -p0 < Razor2.patch |
| |
| or apply to the Razor2 source tree with: |
| |
| patch -p0 -d lib/Razor2 < Razor2.patch |
| |
| Please make sure that no unpatched copies of Razor are installed on your |
| system. Sometimes, there is more than one installed copy. |
| |
| --- Client/Agent.pm~ Tue Nov 19 16:26:05 2002 |
| +++ Client/Agent.pm Sun Sep 21 23:20:47 2003 |
| @@ -969,6 +969,7 @@ |
| my @fns; |
| if (opendir D,$self->{razorhome}) { |
| @fns = map "$self->{razorhome}/$_", grep /^server\.[\S]+\.conf$/, readdir D; |
| + @fns = map { /^(\S+)$/, $1 } @fns; # untaint |
| closedir D; |
| } |
| foreach (@fns) { |
| --- Client/Config.pm~ Thu Nov 14 14:47:01 2002 |
| +++ Client/Config.pm Sun Sep 21 23:18:52 2003 |
| @@ -323,9 +323,11 @@ |
| if ($fn =~ /^(.*)\/([^\/]+)$/) { |
| my $dir = $1; |
| $fn = readlink $fn; |
| + $fn = $1 if $fn =~ /^(\S+)$/; # untaint readlink |
| $fn = "$dir/$fn" unless $fn =~ /^\//; |
| } else { |
| $fn = readlink $fn; |
| + $fn = $1 if $fn =~ /^(\S+)$/; # untaint readlink |
| } |
| } |
| } |
| @@ -366,13 +368,13 @@ |
| chomp; |
| next if /^\s*#/; |
| if ($nothash) { |
| - s/^\s+//; s/\s+$//; |
| + next unless s/^\s*(.+?)\s*$/$1/; # untaint |
| $conf->{$_} = 7; |
| push @lines, $_; |
| } else { |
| next unless /=/; |
| - my ($attribute, $value) = split /\=/, $_, 2; |
| - $attribute =~ s/^\s+//; $attribute =~ s/\s+$//; |
| + my ($attribute, $value) = /^\s*(.+?)\s*=\s*(.+?)\s*$/; # untaint |
| + next unless (defined $attribute && defined $value); |
| $conf->{$attribute} = $self->parse_value($value); |
| } |
| $total++; |
| --- Client/Core.pm~ Wed Nov 13 12:01:10 2002 |
| +++ Client/Core.pm Sun Sep 21 23:20:21 2003 |
| @@ -216,8 +216,10 @@ |
| foreach $rr ($query->answer) { |
| my $pushed = 0; |
| if ($rr->type eq "A") { |
| - push @list, $rr->address; |
| - $pushed = 1; |
| + if ($rr->address =~ m/^(\d+\.\d+\.\d+\.\d+)$/) { |
| + push @list, $1; |
| + $pushed = 1; |
| + } |
| } elsif ($rr->type eq "CNAME") { |
| if ($rr->cname eq 'list.terminator') { |
| pop @list if $pushed; |
