commit c819f3bcad02bcb06004ae2ad135b68fab0ae888
Author: Jeremy Harris <jgh146exb@wizmail.org>
Date:   Wed Jul 7 22:19:07 2021 +0100

    Fix tainted message for fakereject
    
    (cherry picked from commit a9ac2d7fc219e41a353abf1f599258b9b9d21b7e)

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index e60c1cad5..3e93f653f 100644
--- doc/ChangeLog
+++ doc/ChangeLog
@@ -227,6 +227,10 @@ JH/53 Bug 2743: fix immediate-delivery via named queue.  Previously this would
       fail with a taint-check on the spoolfile name, and leave the message
       queued.
 
+JH/57 Fix control=fakreject for a custom message containing tainted data.
+      Previously this resulted in a log complaint, due to a re-expansion present
+      since fakereject was originally introduced.
+
 
 Exim version 4.94
 -----------------
diff --git a/src/src/acl.c b/src/src/acl.c
index 7061230b4..65324405c 100644
--- src/acl.c
+++ src/acl.c
@@ -3137,7 +3137,9 @@ for (; cb; cb = cb->next)
 	    {
 	    const uschar *pp = p + 1;
 	    while (*pp) pp++;
-	    fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
+	    /* The entire control= line was expanded at top so no need to expand
+	    the part after the / */
+	    fake_response_text = string_copyn(p+1, pp-p-1);
 	    p = pp;
 	    }
 	   else /* Explicitly reset to default string */