Re: One BUG found: userpref whitelist pattern BUG/DOC prob;

[Matt Kettler <mk...@verizon.net>]

Bowie Bailey wrote:
> Linda Walsh wrote:
>   
>> 	I found, BURIED, in the doc "Mail::SpamAssassin::Conf the broken,
>> primitive rules for white/black list patterns allowed:
>>     
>
> Where else would they be?  This is the main location for documentation
> of the SA configuration and rule definitions.
>
>   
>>             Whitelist and blacklist addresses are now file-glob-style
>>             patterns, so "friend@somewhere.com", "*@isp.com", or
>>             "*.domain.net" will all work.  Specifically, "*" and "?"
>>             are allowed, but all other metacharacters are not. 
>>             Regular expressions are not used for security reasons.
>> =======================
>>
>> 	These are NOT file-glob style patterns.  As on linux
>> These are examples of non-regex file-glob patterns that don't work
>> under 
>> SA:  "[0-9][0-9a-f]*.domain", "[0-9]*.domain", "[^0-9]*.domain".
>>     
>
>   
Not all systems and shells support []  file-glob modifiers. And as said
by bowie, they're not mentioned in the docs, because they're not supported.
> The documentation you quoted above clearly states that only "*" and "?"
> metacharacters are allowed.
>   

And more to the point, there's a very important reason this is the only
type of pattern allowed. Regular expressions can easily be crafted to
create a lot of load on a server. white/blacklist entries can be created
by "untrusted" end users, who could abuse them to DoS your mailserver.

It may be "primitive", but it's not "broken" and it's done that way very
much on purpose. Supporting file globs is somewhat harder than doing
regexes, which are very natural in perl.

That's why the main configuration docs state:
"Regular expressions are not used for security reasons."



> making clear whether the pattern provided must match the full email
> > address, or if a partial match will be considered a a positive match
> > (i.e. "@foobar" is same as "*@foobar*")
>   
>
> I agree that it would be useful to have this stated explicitly in the
> documentation.
>   

Agreed, that's lacking.

Re: One BUG found: userpref whitelist pattern BUG/DOC prob;

[LuKreme <kr...@kreme.com>]

On 1-Apr-2009, at 22:00, Matt Kettler wrote:
> white/blacklist entries can be created by "untrusted" end users, who  
> could abuse them to DoS your mailserver.

then it should be an option.  Only TRUSTED end-users have access to a  
shell and to user_prefs on my system (and I suspect on lots of other  
systems, I doubt I am special).

-- 
and I lift my glass to the Awful Truth / which you can't reveal to
	the Ears of Youth / except to say it isn't worth a dime