MailList.HasExplicitDest(): Protect use of user-supplied regexp. If

  the regexp specifying a list alias doesn't compile, match against
  the re.escape(invalid_regexp) instead.
MailList.parse_matching_header_opt(): Only return triples having
  compileable regexps.  If some line in `bounce_matching_headers'
  results in an invalid regexp, this is logged and ignored (possibly a
  lot of times, until the misconfiguration is fixed).
  Also, the re.split() on the lines in `bounce_matching_headers' is
  now called with third arg `maxsplit' set to 1 to avoid splitting the
  header lines more than once.  I don't have any Python prior to 1.5.1
  handy, but my copy of the Library Reference states that this
  argument was ignored in the original 1.5 release -- implying that it
  existed.

1 files changed, 24 insertions, 4 deletions

diff --git a/Mailman/MailList.py b/Mailman/MailList.py
index 186950e04..acb2a12b5 100644
--- a/Mailman/MailList.py
+++ b/Mailman/MailList.py
@@ -956,8 +956,16 @@ class MailList(MailCommandHandler, HTMLFormatter, Deliverer, ListAdmin,
         for recip in recips:
             for alias in string.split(self.acceptable_aliases, '\n'):
                 stripped = string.strip(alias)
-                if stripped and re.match(stripped, recip):
-                    return 1
+                try:
+                    # The list alias in `stripped` is a user supplied regexp,
+                    # which could be malformed.
+                    if stripped and re.match(stripped, recip):
+                        return 1
+                except re.error:
+                    # `stripped' is a malformed regexp -- try matching
+                    # safely, with all non-alphanumerics backslashed:
+                    if stripped and re.match(re.escape(stripped), recip):
+                        return 1
 	return 0
 
     def parse_matching_header_opt(self):
@@ -973,8 +981,18 @@ class MailList(MailCommandHandler, HTMLFormatter, Deliverer, ListAdmin,
 		continue
 	    else:
 		try:
-		    h, e = re.split(":[ 	]*", stripped)
-		    all.append((h, e, stripped))
+		    h, e = re.split(":[ \t]*", stripped, 1)
+                    try:
+                        re.compile(e)
+                        all.append((h, e, stripped))
+                    except re.error, cause:
+                        # The regexp in this line is malformed -- log it
+                        # and ignore it
+                        self.LogMsg("config", "%s - "
+                                    "bad regexp %s [%s] "
+                                    "in bounce_matching_header line %s"
+                                    % (self.real_name, `e`,
+                                       `cause`, `stripped`))
 		except ValueError:
 		    # Whoops - some bad data got by:
 		    self.LogMsg("config", "%s - "
@@ -1010,6 +1028,8 @@ class MailList(MailCommandHandler, HTMLFormatter, Deliverer, ListAdmin,
 		    # Continuation line.
 		    subjs[-1] = subjs[-1] + f
 	    for s in subjs:
+                # This is safe because parse_matching_header_opt only
+                # returns valid regexps
 		if re.search(matchexp, s, re.I):
 		    return line
 	return 0