Stowage/cpython
2
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2026-01-30 11:12:06 +00:00
Code Issues Projects Releases Packages Wiki Activity

gh-143921: Reject control characters in IMAP commands

Browse source
This commit is contained in:
Seth Michael Larson 2026-01-20 14:45:42 -06:00 • committed by GitHub
parent 27a7160b8b
commit 6262704b13
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 10 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Lib/imaplib.py
View file

@ -129,7 +129,7 @@
# We compile these in _mode_xxx.
_Literal = br'.*{(?P<size>\d+)}$'
_Untagged_status = br'\* (?P<data>\d+) (?P<type>[A-Z-]+)( (?P<data2>.*))?'
_control_chars = re.compile(b'[\x00-\x1F\x7F]')
class IMAP4:
@ -1105,6 +1105,8 @@ def _command(self, name, *args):
if arg is None: continue
if isinstance(arg, str):
arg = bytes(arg, self._encoding)
if _control_chars.search(arg):
raise ValueError("Control characters not allowed in commands")
data = data + b' ' + arg
literal = self.literal

6
Lib/test/test_imaplib.py
View file

@ -657,6 +657,12 @@ def test_unselect(self):
self.assertEqual(data[0], b'Returned to authenticated state. (Success)')
self.assertEqual(client.state, 'AUTH')
def test_control_characters(self):
client, _ = self._setup(SimpleIMAPHandler)
for c0 in support.control_characters_c0():
with self.assertRaises(ValueError):
client.login(f'user{c0}', 'pass')
# property tests
def test_file_property_should_not_be_accessed(self):

1
Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst Normal file
View file

@ -0,0 +1 @@
Reject control characters in IMAP commands.