Subject: Re: FAQ? and a question

From: [email-masked] (David W. Tamkin)
Date: Tue, 18 Oct 1994 15:04:26 -0500 (CDT)

Walt Dabell asked:

| I would like to set up a .procmailrc file to look for a certian
| user, use the Subject: contents as a path/file.name and strip the
| header off. If the filename exists, it should be written over. 
| Is this possible?

The tricky part is the clobbering, since procmail by default appends when
it writes.  Here goes:

 :0b
 * ^From:.*that_user
 | cat > `formail -xsubject:`

If there is a security risk that the subject will contain semicolons or
pipes, this might be better:

 :0
 * ^From:.*that_user
 {
  place=`formail -xsubject:`

  :0b
  | cat > $MAILDIR/"$place"
 }

David W. Tamkin  P. O. Box 3284  Skokie IL  60076-6284
[email-masked]   MCI Mail: 426-1818   +1 312 714 5610

---

From: [email-masked] (David W. Tamkin)
Date: Wed, 19 Oct 1994 13:13:54 -0500 (CDT)

Walt Dabell asked:

D> I would like to set up a .procmailrc file to look for a certian
D> user, use the Subject: contents as a path/file.name and strip the
D> header off. If the filename exists, it should be written over. 
D> Is this possible?

I suggested a way to do it, and Stephen van den Berg commented,

B> This still leaves one security hole wide open: anyone can put "/../" in
B> the pathname (thereby overwriting any of your files).

Well, not anyone; just the particular sender being watched for or someone
who knows (1) who that sender is and (2) that Walt has such a recipe and
therefore fakes mail from that sender.

Otherwise, I'm not sure what to make of Stephen's response.  Should Walt
therefore not implement such a feature, should he make sure that the subject
line doesn't contain "..":

 * !^Subject:.*\.\.

(in which case he still is vulnerable to losing another valuable folder, so
perhaps $MAILDIR is the wrong place), or should he take other precautions?

For example, this is something Stephen himself pointed out to me some time
ago:

  | cat > $MAILDIR/sp$place

as long as no directory in $MAILDIR begins with "sp" (or whatever string Walt
picks) and no folder used for other mail begins with that string either, that
should limit the trouble.

However, here's the problem: the sender is should, per Walt's original post,
be able to specify the full path to the file to clobber.  Apparently the
sender is supposed to have that power and be able to replace any file to
which Walt may write or to create a file in any directory where Walt may
write and can be trusted, but there is a risk that someone faking mail from
the authorized sender can do the same thing.

I don't see an easy answer.