In fact, it's explicitly listed in the man page for qmail-command:
ENVIRONMENT VARIABLES
qmail-local supplies several useful environment variables to
command. WARNING: These environment variables are not
quoted. They may contain special characters. They are
under the control of a possibly malicious remote user.
edit: which is to say, yes, djb thought of it a long time ago.
ENVIRONMENT VARIABLES qmail-local supplies several useful environment variables to command. WARNING: These environment variables are not quoted. They may contain special characters. They are under the control of a possibly malicious remote user.
edit: which is to say, yes, djb thought of it a long time ago.