Bug #2343 for SyslogScan: SyslogScan SendmailUtil does not parse "to" lines with [more] properly

Fri Apr 04 17:42:16 2003 Guest - Ticket created

Subject:

SyslogScan SendmailUtil does not parse "to" lines with [more] properly

The following sendmail line (names changed to protect the guilty) Mar 28 16:17:11 hostname sendmail[13060]: h2SLGEg13057: to=<address@domain.com>,<another@domain.com>>, [more], ctladdr=<sender@sender.domain.com> (102/103), delay=00:00:57, xdelay=00:00:57, mailer=smtpf, pri=3000674, relay=smtpf, dsn=2.0.0, stat=Sent Does not properly parse as a valid sendmail "To" line. Due to the [more], I believe.

Mon Apr 07 10:52:37 2003 Guest - Correspondence added

Subject:	This fixes it
From:	richardh [...] roamsecure.net

Fixed, here's the patch. I don't claim to be a perl god, so if someone would be so kind as to inspect the added code, or make it better would be greatly appreciated. Richard

--- /usr/lib/perl5/site_perl/5.6.1/SyslogScan/SendmailLineTrans.pm Mon Dec 2 09:29:07 1996 +++ SendmailLineTrans.pm Mon Apr 7 10:47:28 2003 @@ -125,13 +125,27 @@ sub _listToHash { - my ($self, @list) = @_; - my (%hash); - foreach (@list) + my ($self, @list) = @_; + my (%hash); + + my @fixed_list; + foreach (reverse @list) + { + if ($_ !~ m/=/) { - s/\'/\"/g; # TODO: remove this eroot-compatibility hack - die "equals not found in $_" unless /([^=]+)=(.+)/; - $hash{$1} = $2; + my $attr = shift @fixed_list; + $attr .= ", $_"; + unshift @fixed_list,$attr; + } else { + unshift @fixed_list,$_; } - %hash; + } + undef @list; @list = @fixed_list; + foreach (@list) + { + s/\'/\"/g; # TODO: remove this eroot-compatibility hack + die "equals not found in $_" unless /([^=]+)=(.+)/; + $hash{$1} = $2; + } + return %hash; }

Mon Apr 07 11:09:05 2003 Guest - Correspondence added

From:

richardh [...] roamsecure.net

better patch, this one removes the [more] from the toList.

--- /usr/lib/perl5/site_perl/5.6.1/SyslogScan/SendmailLineTrans.pm Mon Dec 2 09:29:07 1996 +++ SendmailLineTrans.pm Mon Apr 7 11:04:19 2003 @@ -125,13 +125,32 @@ sub _listToHash { - my ($self, @list) = @_; - my (%hash); - foreach (@list) + my ($self, @list) = @_; + my (%hash); + + my @fixed_list; + foreach (reverse @list) + { + if ($_ !~ m/=/) { - s/\'/\"/g; # TODO: remove this eroot-compatibility hack - die "equals not found in $_" unless /([^=]+)=(.+)/; - $hash{$1} = $2; + my $attr = shift @fixed_list; + if (($attr =~ m/^to=/) && ($_ =~ m/\[more\]/)) + { + unshift @fixed_list, $attr; + next; + } + else { $attr .= ",$_"; } + unshift @fixed_list,$attr; + } else { + unshift @fixed_list,$_; } - %hash; + } + undef @list; @list = @fixed_list; + foreach (@list) + { + s/\'/\"/g; # TODO: remove this eroot-compatibility hack + die "equals not found in $_" unless /([^=]+)=(.+)/; + $hash{$1} = $2; + } + return %hash; }