Subject: Re: Creating a basic auto-responder.

From: Adam Shostack <[email-masked]>
Date: Fri, 23 Dec 94 14:07:28 EST

|    mail me with the Subject: <filename I allow> to return a copy of that 
|       file by e-mail.
|    mail me with the Subject: finger to return the output of a perl program
|       that fingers me, since localhost doesn't allow incoming fingers.

	You might decide to discuss the second rule with your systems
manager; people often disallow finger for solid security reasons.  The
rule presented doesn't allow fingering of arbitrary people, doesn't
allow the passage of arbitrary arguments, and doesn't take any
argument at all from the user.  The reply-to rule is to prevent people
from adding a reply-to header with unusual characters in it.  Denial
of oddities is a good thing if you're worried about security stuff.

Adam

:0 
* ^Subject: SEND FILE [0-9a-z][-_/0-9a-z.]+$
* !^Subject:.*[ /.]\.
* !^FROM_DAEMON
{
   # FILE=`formail -x Subject: | sed 's/.* //'`
   FILE=`sed -n -e '/Subject:/s/.* //p' -e '/^$/q'`

  :0c 
  | (formail -rt -A"Precedence: junk";\
    cat $HOME/.outbound/$FILE) | $SENDMAIL -t

  :0: 
  $MAILDIR/.log
}
 
:0
* ^Subject: finger
* (^reply-to:)* [-_0-9a-z.]*
| (formail -r ; finger jcooper ) | $SENDMAIL -t

---

From: [email-masked] (David W. Tamkin)
Date: Fri, 23 Dec 1994 16:30:04 -0600 (CST)

Adam Shostack suggested to Jonathan Cooper:

| The reply-to rule is to prevent people
| from adding a reply-to header with unusual characters in it.

| :0
| * ^Subject: finger
| * (^reply-to:)* [-_0-9a-z.]*
| | (formail -r ; finger jcooper ) | $SENDMAIL -t

That second condition will match any letter that has a space in its header,
such as the space after "From" on the top line, so it doesn't offer the
protection Adam intended.

Try this instead:

 :0
 * ^Subject: ?finger( j(on(athan)? +)?cooper)?$
 {
  :0c: # store it for the fingeree's reading pleasure on cold nights
  fingerrequests

  # Rather than checking for funny characters in Reply-To: and then having
  # to view other headers if no Reply-To: exists, let formail pick out the
  # reply address first.  Formail will also remove comments and additional
  # addresses, so commas, parentheses, angle brackets, and embedded spaces
  # also become "funny" if any survive.

  :0fwh
  | formail -r

  :0bfi
  * !^To: *[- !"%'+.-:=@-Z_a-z]+$
  | finger jcooper
   :0A
   ! -t

  # Quicktrash anything that had a funny character in the reply address:

  LASTFOLDER=badfinger HOST=bitbucket
 }

David W. Tamkin  Box 3284  Skokie, Illinois  60076-6284
[email-masked]    MCI Mail: 426-1818   +1 312 714 5610

---

From: Adam Shostack <[email-masked]>
Date: Fri, 23 Dec 94 17:42:06 EST

| Adam Shostack suggested to Jonathan Cooper:

| | * (^reply-to:)* [-_0-9a-z.]*

| That second condition will match any letter that has a space in its header,
| such as the space after "From" on the top line, so it doesn't offer the
| protection Adam intended.

	Curses! Foiled again!

	(And thanks again for catching it, David.)

| Try this instead:
|
|  :0
|  * ^Subject: ?finger( j(on(athan)? +)?cooper)?$
|  {
|   :0c: # store it for the fingeree's reading pleasure on cold nights
|   fingerrequests
|
|   # Rather than checking for funny characters in Reply-To: and then having
|   # to view other headers if no Reply-To: exists, let formail pick out the
|   # reply address first.  Formail will also remove comments and additional
|   # addresses, so commas, parentheses, angle brackets, and embedded spaces
|   # also become "funny" if any survive.
| 
|   :0fwh
|   | formail -r
| 
|   :0bfi
|   * !^To: *[- !"%'+.-:=@-Z_a-z]+$
|   | finger jcooper
|    :0A
|    ! -t

	I think you forgot ; as an invalid character, and all of %": are
valid.  (% as part of an address, "to enclose a name" and :: as part
of a decnet address improperly hiding its shame.)  Its better to say
what is accepted than what is not:

:0i
*^To: *[A-Za-z0-9@:%!" +-]+$
| finger jcooper | $SENDMAIL -t

Adam

---

From: [email-masked] (David W. Tamkin)
Date: Fri, 23 Dec 1994 17:06:32 -0600 (CST)

I suggested,

T>   [silly mistake deleted]

Adam Shostack replied,

S> 	I think you forgot ; as an invalid character, and all of %": are
S> valid.  (% as part of an address, "to enclose a name" and :: as part
S> of a decnet address improperly hiding its shame.)  Its better to say
S> what is accepted than what is not:

S> :0i
S> *^To: *[A-Za-z0-9@:%!" +-]+$
S> | finger jcooper | $SENDMAIL -t

Oops.  Thanks for catching the goof, Adam.  Though it isn't necessarily
better to say what is accepted than what isn't -- computers aren't people and
won't remember every word you said except "not" -- this time I did mean to
list what *is* accepted.  Take off the exclamation point at the beginning
(originally I was going to list invalid characters) and change my suggestion
to this:

      :0fw # We can lose the old body here, come to think of it.
      | formail -r

      :0bfi
      * ^To: *[- !"%'+.-:=@-Z_a-z]+$
      | finger jcooper
       :0A
       ! -t

Now that it's fixed it *does* forbid semicolons and permit percent signs,
quotation marks, and colons.  The only differences between Adam's expression
and mine (now that I put the logic in the right direction) are that I'm 
permitting periods [you need those at least for FQDN's and sometimes for
local parts], foreslashes, apostrophes, and underscores.

I wonder if the ^TO token could come into play here; I'd tend to think not
because it allows zero or one occurrence of any string not ending in a digit
or a letter.  As long as the last character on the line is legal, anything
before it would slip into the ^TO token.

I broke it into two to avoid forking a shell for the pipe.

But aside from that, Adam, your action line won't work.  If you pipe
finger jcooper | $SENDMAIL -t, sendmail won't find any addresses.

DWT