Re: Procmail feature security hole?

[Billy D. <bi...@da...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, 3 Oct 2000, Frank Tobin wrote:

> This is a harder task to determine than one would think (I think).

I found a module that will help.. `String::Approx'
Here's my idea for using it.  Don't consider this a patch or
anything.. I'm actually going to test this out.


use String::Approx   qw( aindex );

#
#  Detect forged pgpenvelope borders.
#
# Check a line of data.
# Perform an approximate match against the pgpenvelope border messages.
# If the match is not flush against the left side, then there is no
# cause for alarm, and a 0 is returned
#
# return 1 if any lines were within a 10% margin. (User should be warned).
#            This means that up to 9 characters in 10 correctly matched
#            his border string without any edits.
# return 0 if everything is okay.
#

sub detect_forged_borders
{

	my ($line) = @_;
	my @bordernames = qw( top-border info-top-border info-bottom-border);
        my @borders = map { $config->get($_) } @bordernames;

	for my $b (@borders) {
		return 1 if aindex($b, $line) == 0;
	}
	return 0;
}

- --
"The Funk, the whole Funk, and nothing but the Funk."
Linux barcode software mirror: http://dadadada.net/cuecat
Billy Donahue <mailto:bi...@da...>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.3 (GNU/Linux)
Comment: pgpenvelope 2.9.0 - http://pgpenvelope.sourceforge.net/

iD8DBQE52aaD+2VvpwIZdF0RAon/AJ4juIMzlhSgB6LS1hiszRWo3h+6wwCeMSnv
ZmOH3pwY6ZQco5ihP5dvPPo=
=aNPW
-----END PGP SIGNATURE-----