Stowage/cpython
2
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-12-08 06:10:17 +00:00
Code Issues Projects Releases Packages Wiki Activity

[3.9] gh-121284: Fix email address header folding with parsed encoded-word (GH-122754) (GH-131412)

Browse source 
Email generators using email.policy.default may convert an RFC 2047
encoded-word to unencoded form during header refolding. In a structured
header, this could allow 'specials' chars outside a quoted-string,
leading to invalid address headers and enabling spoofing. This change
ensures a parsed encoded-word that contains specials is kept as an
encoded-word while the header is refolded.

[Better fix from @bitdancer.]

(cherry picked from commit 295b53df2a)

Co-authored-by: Mike Edmunds <medmunds@gmail.com>
Co-authored-by: R David Murray <rdmurray@bitdance.com>
This commit is contained in:
Petr Viktorin 2025-04-03 18:27:33 +02:00 • committed by GitHub
parent ff4e5c2566
commit 9a31386eec
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 37 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

25
Lib/test/test_email/test__header_value_parser.py
View file

@ -2946,6 +2946,31 @@ def test_address_list_with_unicode_names_in_quotes(self):
'=?utf-8?q?H=C3=BCbsch?= Kaktus <beautiful@example.com>,\n'
' =?utf-8?q?bei=C3=9Ft_bei=C3=9Ft?= <biter@example.com>\n')
def test_address_list_with_specials_in_encoded_word(self):
# An encoded-word parsed from a structured header must remain
# encoded when it contains specials. Regression for gh-121284.
policy = self.policy.clone(max_line_length=40)
cases = [
# (to, folded)
('=?utf-8?q?A_v=C3=A9ry_long_name_with=2C_comma?= <to@example.com>',
'A =?utf-8?q?v=C3=A9ry_long_name_with?=\n'
' =?utf-8?q?=2C?= comma <to@example.com>\n'),
('=?utf-8?q?This_long_name_does_not_need_encoded=2Dword?= <to@example.com>',
'This long name does not need\n'
' encoded-word <to@example.com>\n'),
('"A véry long name with, comma" <to@example.com>',
# (This isn't the best fold point, but it's not invalid.)
'A =?utf-8?q?v=C3=A9ry_long_name_with?=\n'
' =?utf-8?q?=2C?= comma <to@example.com>\n'),
('"A véry long name containing a, comma" <to@example.com>',
'A =?utf-8?q?v=C3=A9ry?= long name\n'
' containing =?utf-8?q?a=2C?= comma\n'
' <to@example.com>\n'),
]
for (to, folded) in cases:
with self.subTest(to=to):
self._test(parser.get_address_list(to)[0], folded, policy=policy)
# XXX Need tests with comments on various sides of a unicode token,
# and with unicode tokens in the comments. Spaces inside the quotes
# currently don't do the right thing.