Re: [maildropl] maildrop - mailbot adding full message to autoreply

[Sam V. <mr...@co...>]

David Tenney writes:

> Sam,
> 
> Ok so here is what I have:
> 
> cc "| sed /\^\$/,\$d | mailbot -t .autoreply -s 'Auto Reply' -M $FROM /usr/sbin/sendmail"

Two problems here:

I already mentioned why using environment variables from untrusted source is 
a gaping security hole. Perhaps this wasn't clear, but the parameter to -M 
is not the sender's address. As specified in the man page, this parameter: 
"is an RFC 2822 E-mail address that generates the DSN".

This DSN is not generated by the /sender/, but by you. You are the one 
generating this autoreply, not the sender, of course. This parameter is 
simply your email address, and nothing more.

But this is not even the cause of your problem, though. The maildrop command 
is:

cc "| sed /\^\$/,\$d | mailbot -t .autoreply -s 'Auto Reply' -M us...@do... /usr/sbin/sendmail"

When maildrop parses this recipe file, the literal string quoted in double 
quotes becomes:

sed /^$/,$d | mailbot -t .autoreply -s 'Auto Reply' -M us...@do... /usr/sbin/sendmail

This is what the literal string gets parsed as. As explained in the 
maildropfilter man page, double quotes cause the literal string to be 
expanded for variable substituation and escape characters. The above string 
gets passed to the shell, for execution. As you probably know, when the 
shell sees the $ character it does its own variable substitution too.

Try executing this by hand:

$ ls | sed /^$/,$d
sed: -e expression #1, char 5: unexpected `,'

You were on the right track by backslash-escaping the sed parameter, but it 
wasn't obvious to you that the parsed string then gets executed by the shell 
which does its own variable substitution, so you need to slap on the 
apostrophes here, just like with parameters to the rest of the command:

cc "| sed '/\^\$/,\$d' | mailbot -t .autoreply -s 'Auto Reply' -M us...@do... /usr/sbin/sendmail"

Depending upon your DSN email address, you may also need to use apostrophes 
with the -M option, too.