From 6730d28bfb0d62d9be6e68425d7f6988fbb35aa1 Mon Sep 17 00:00:00 2001
From: David Woodhouse <dwmw@amazon.co.uk>
Date: Thu, 25 Jan 2024 14:22:29 +0000
Subject: [PATCH] untaint mailman actions

---
 mailman_suffixes | 7 +++++++
 master           | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)
 create mode 100644 mailman_suffixes

diff --git a/mailman_suffixes b/mailman_suffixes
new file mode 100644
index 0000000..490f2a3
--- /dev/null
+++ b/mailman_suffixes
@@ -0,0 +1,7 @@
+bounces
+confirm
+join
+leave
+owner
+request
+admin
diff --git a/master b/master
index 163faea..1003ea9 100644
--- a/master
+++ b/master
@@ -502,7 +502,7 @@ mailman_transport:
   driver = pipe
   command = MAILMAN_WRAP \
             '${if def:local_part_suffix \
-                  {${sg{$local_part_suffix}{-(\\w+)(\\+.*)?}{\$1}}} \
+                  {${lookup{${sg{$local_part_suffix}{-(\\w+)(\\+.*)?}{\$1}}}lsearch,ret=key{CONFDIR/mailman_suffixes}{$value}fail}} \
                   {post}}' \
             MAILMAN_UNTAINT_LOCALPART
   current_directory = MAILMAN_HOME
-- 
2.49.0