More taint mode problems (please help)

[Jules Field]

The File.pm module is used for opening files, not the "file" command. It 
could be loads of places.
What TNEF-related options are you using, and can you send me a message 
that triggers it? Put the raw message queue files up on a website 
somewhere and mail me the URL to the address in the headers.

Thanks,
Jules.

On 13/01/2010 19:02, Garrod M. Alwood wrote:
> I am using both the patch and the latest beta and I'm still getting 
> the issue. I'll keep looking for where the problem is. Could it be 
> when you call the for the file command?
> Garrod M. Alwood
> Consultant
> garrod.alwood at lorodoes.com <mailto:garrod.alwood at lorodoes.com>
> 904.738.4988
> ------------------------------------------------------------------------
> *From:* mailscanner-bounces at lists.mailscanner.info 
> [mailscanner-bounces at lists.mailscanner.info] On Behalf Of Jules Field 
> [MailScanner at ecs.soton.ac.uk]
> *Sent:* Wednesday, January 13, 2010 2:00 PM
> *To:* MailScanner discussion
> *Subject:* Re: More taint mode problems (please help)
>
> Try out the latest beta with the patch I just posted an hour or two ago.
> Then tell me if there's still a problem. But I need a pointer to an
> error in my code, not in File.pm as that doesn't help me much, sorry.
>
> Thanks!
> Jules.
>
> On 13/01/2010 18:26, Garrod M. Alwood wrote:
> > I don't know if this a failure on my part or not, but when certain
> > file types come in I get the below error and this what I am running
> > ubuntu 9.10 with perl 5.10 and MailScanner 4.79.5-1.
> > Insecure dependency in open while running with -T switch at
> > /usr/lib/perl/5.10/IO/File.pm line 63.
> >
> > 60:           return open($fh, $mode, $file) if @_ == 3;
> >
> > 61:           croak 'usage: $fh->open(FILENAME, IOLAYERS)';
> >
> > 62:       } else {
> >
> > 63:            return open($fh, IO::Handle::_open_mode_string($mode),
> > $file);
> >
> > Garrod M. Alwood
> > Consultant
> > garrod.alwood at lorodoes.com <mailto:garrod.alwood at lorodoes.com>
> > 904.738.4988
> > ------------------------------------------------------------------------
> > *From:* mailscanner-bounces at lists.mailscanner.info
> > [mailscanner-bounces at lists.mailscanner.info] On Behalf Of Jules Field
> > [MailScanner at ecs.soton.ac.uk]
> > *Sent:* Wednesday, January 13, 2010 11:41 AM
> > *To:* MailScanner discussion
> > *Subject:* Re: More taint mode problems (please help)
> >
> > Please can you try the attached patch to TNEF.pm.
> > Please let me know if it solves the problem or not.
> >
> > Thanks!
> > Jules.
> >
> > On 13/01/2010 16:19, Thomas Lohman wrote:
> > >
> > >> I've released 4.79.5, which I would gratefully appreciate you 
> testing.
> > >
> > > Hi Julian,
> > >
> > > I've installed version 4.79.5 on a RH5 box with perl 5.10.1 and have
> > > been running it against our production e-mail traffic and I noticed
> > > this morning that taint errors still are happening when processing
> > > TNEF attachments.  This is the line which is output when running a
> > > single message through in debug mode:
> > >
> > > 11:17:22 Insecure dependency in rename while running with -T switch at
> > > /usr/local/MailScanner/lib/MailScanner/TNEF.pm line 357.
> > >  Failed.
> > >
> > > Let me know if there is any more information you need or if there is
> > > some other patch I may be missing.
> > >
> > > thanks much,
> > >
> > >
> > > --tom
> > >
> >
> > Jules
> >
> > --
> > Julian Field MEng CITP CEng
> > www.MailScanner.info <http://www.mailscanner.info/> 
> <http://www.mailscanner.info/>
> > Buy the MailScanner book at www.MailScanner.info/store 
> <http://www.mailscanner.info/store>
> > <http://www.mailscanner.info/store>
> >
> > Need help customising MailScanner?
> > Contact me!
> > Need help fixing or optimising your systems?
> > Contact me!
> > Need help getting you started solving new requirements from your boss?
> > Contact me!
> >
> > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> > Follow me at twitter.com/JulesFM and twitter.com/MailScanner
> >
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean.
> >
>
> Jules
>
> -- 
> Julian Field MEng CITP CEng
> www.MailScanner.info <http://www.mailscanner.info/>
> Buy the MailScanner book at www.MailScanner.info/store 
> <http://www.mailscanner.info/store>
>
> Need help customising MailScanner?
> Contact me!
> Need help fixing or optimising your systems?
> Contact me!
> Need help getting you started solving new requirements from your boss?
> Contact me!
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> Follow me at twitter.com/JulesFM and twitter.com/MailScanner
>
>
> -- 
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> -- 
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!

Jules

-- 
Julian Field MEng CITP CEng
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

Need help customising MailScanner?
Contact me!
Need help fixing or optimising your systems?
Contact me!
Need help getting you started solving new requirements from your boss?
Contact me!

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
Follow me at twitter.com/JulesFM and twitter.com/MailScanner


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.