msimerson / mail-dmarc

Mail::DMARC, a complete DMARC implementation in Perl
Other
33 stars 23 forks source link

Several issues in file search functions #231

Closed mpurg closed 3 months ago

mpurg commented 5 months ago

Hi,

I noticed a few non-critical issues in the find_psl_file and get_config functions:

1) The variable $path is referenced outside the foreach loop and is thus uninitialized, thus the following will never be true: https://github.com/msimerson/mail-dmarc/blob/ac6d3ad2e50c79a409c0fc642ffc2816c2018827/lib/Mail/DMARC/Base.pm#L201

2) The default value for $file is share/public_suffic_list while at the same time, get_prefix is called with the prefix share/, resulting in .../share/share/... paths, which is probably not intended.

3) In get_config , the config file is first read from CWD without checking ownership/permissions, which could be a security issue.