2 files changed, 33 insertions, 4 deletions

diff --git a/mail/razor-agents/files/patch-lib::Razor2::Client::Agent.pm b/mail/razor-agents/files/patch-lib::Razor2::Client::Agent.pm
index 808e3d7eed0f..4903fa5be7b1 100644
--- a/mail/razor-agents/files/patch-lib::Razor2::Client::Agent.pm
+++ b/mail/razor-agents/files/patch-lib::Razor2::Client::Agent.pm
@@ -15,3 +15,11 @@
          }
          next unless defined(my $line = <$fh>);
          if ($line =~ /^From /) {
+@@ -969,6 +969,7 @@
+     my @fns;
+     if (opendir D,$self->{razorhome}) {
+         @fns = map "$self->{razorhome}/$_", grep /^server\.[\S]+\.conf$/, readdir D;
++        @fns = map { /^(\S+)$/, $1 } @fns; # untaint
+         closedir D;
+     }
+     foreach (@fns) {
diff --git a/mail/razor-agents/files/patch-lib::Razor2::Client::Config.pm b/mail/razor-agents/files/patch-lib::Razor2::Client::Config.pm
index da79781bc383..ad400c27fca9 100644
--- a/mail/razor-agents/files/patch-lib::Razor2::Client::Config.pm
+++ b/mail/razor-agents/files/patch-lib::Razor2::Client::Config.pm
@@ -1,10 +1,31 @@
 --- lib/Razor2/Client/Config.pm.orig	2002-11-25 19:13:59.000000000 +0100
 +++ lib/Razor2/Client/Config.pm	2002-11-11 19:29:17.000000000 +0100
-@@ -373,6 +373,7 @@
+@@ -323,9 +323,11 @@
+         if ($fn =~ /^(.*)\/([^\/]+)$/) {
+             my $dir = $1;
+             $fn = readlink $fn;
++            $fn = $1 if $fn =~ /^(\S+)$/; # untaint readlink
+             $fn = "$dir/$fn" unless $fn =~ /^\//;
+         } else {
+             $fn = readlink $fn;
++            $fn = $1 if $fn =~ /^(\S+)$/; # untaint readlink
+         }
+     }
+ }
+@@ -366,13 +368,13 @@
+         chomp; 
+         next if /^\s*#/;
+         if ($nothash) {
+-            s/^\s+//; s/\s+$//;
++            next unless s/^\s*(.+?)\s*$/$1/; # untaint
+             $conf->{$_} = 7;
+             push @lines, $_;
+         } else { 
              next unless /=/;
-             my ($attribute, $value) = split /\=/, $_, 2; 
-             $attribute =~ s/^\s+//; $attribute =~ s/\s+$//;
-+            $value = $1  if $value =~ /^(.*)$/;  # untaint!
+-            my ($attribute, $value) = split /\=/, $_, 2; 
+-            $attribute =~ s/^\s+//; $attribute =~ s/\s+$//;
++            my ($attribute, $value) = /^\s*(.+?)\s*=\s*(.+?)\s*$/; # untaint
++            next unless (defined $attribute && defined $value);
              $conf->{$attribute} = $self->parse_value($value);
          }
          $total++;