Doc/Spec: section "Trust in configuration data"

[exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 0393ec28aaca06d1c5311a7c54145faf4fab77c6..c71dfda7356876e0e391b7df2ef73f381b0a8596 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -9892,12 +9892,12 @@ when &%length%& is used as an operator.
 The string is interpreted as a list and the number of items is returned.
 
 
-.vitem &*${listnamed:*&<&'name'&>&*}*&&~and&~&*${list_*&<&'type'&>&*name*&>&*}*&
+.vitem &*${listnamed:*&<&'name'&>&*}*&&~and&~&*${listnamed_*&<&'type'&>&*:*&<&'name'&>&*}*&
 .cindex "expansion" "named list"
 .cindex "&%listnamed%& expansion item"
 The name is interpreted as a named list and the content of the list is returned,
 expanding any referenced lists, re-quoting as needed for colon-separation.
-If the optional type if given it must be one of "a", "d", "h" or "l"
+If the optional type is given it must be one of "a", "d", "h" or "l"
 and selects address-, domain-, host- or localpart- lists to search among respectively.
 Otherwise all types are searched in an undefined order and the first
 matching list is returned.
@@ -13039,7 +13039,7 @@ listed in more than one group.
 .section "TLS" "SECID108"
 .table2
 .row &%gnutls_compat_mode%&          "use GnuTLS compatibility mode"
-.row &%gnutls_enable_pkcs11%&        "allow GnuTLS to autoload PKCS11 modules"
+.row &%gnutls_allow_auto_pkcs11%&    "allow GnuTLS to autoload PKCS11 modules"
 .row &%openssl_options%&             "adjust OpenSSL compatibility options"
 .row &%tls_advertise_hosts%&         "advertise TLS to these hosts"
 .row &%tls_certificate%&             "location of server certificate"
@@ -14077,7 +14077,7 @@ implementations of TLS.
 
 
 .new
-option gnutls_enable_pkcs11 main boolean unset
+option gnutls_allow_auto_pkcs11 main boolean unset
 This option will let GnuTLS (2.12.0 or later) autoload PKCS11 modules with
 the p11-kit configuration files in &_/etc/pkcs11/modules/_&.
 
@@ -35863,6 +35863,8 @@ are given in chapter &<<CHAPappendfile>>&.
 
 .new
 .section "Running local commands" "SECTsecconslocalcmds"
+.cindex "security" "local commands"
+.cindex "security" "command injection attacks"
 There are a number of ways in which an administrator can configure Exim to run
 commands based upon received, untrustworthy, data. Further, in some
 configurations a user who can control a &_.forward_& file can also arrange to
@@ -35907,6 +35909,41 @@ Consider the use of the &%inlisti%& expansion condition instead.
 
 
 
+
+.new
+.section "Trust in configuration data" "SECTsecconfdata"
+.cindex "security" "data sources"
+.cindex "security" "regular expressions"
+.cindex "regular expressions" "security"
+.cindex "PCRE" "security"
+If configuration data for Exim can come from untrustworthy sources, there
+are some issues to be aware of:
+
+.ilist
+Use of &%${expand...}%& may provide a path for shell injection attacks.
+.next
+Letting untrusted data provide a regular expression is unwise.
+.next
+Using &%${match...}%& to apply a fixed regular expression against untrusted
+data may result in pathological behaviour within PCRE.  Be aware of what
+"backtracking" means and consider options for being more strict with a regular
+expression. Avenues to explore include limiting what can match (avoiding &`.`&
+when &`[a-z0-9]`& or other character class will do), use of atomic grouping and
+possessive quantifiers or just not using regular expressions against untrusted
+data.
+.next
+It can be important to correctly use &%${quote:...}%&,
+&%${quote_local_part:...}%& and &%${quote_%&<&'lookup-type'&>&%:...}%& expansion
+items to ensure that data is correctly constructed.
+.next
+Some lookups might return multiple results, even though normal usage is only
+expected to yield one result.
+.endlist
+.wen
+
+
+
+
 .section "IPv4 source routing" "SECID272"
 .cindex "source routing" "in IP packets"
 .cindex "IP source routing"