forked from python/cpython
-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
00435: pythongh-121650: Encode newlines in headers, and verify
headers are sound (pythonGH-122233) Per RFC 2047: > [...] these encoding schemes allow the > encoding of arbitrary octet values, mail readers that implement this > decoding should also ensure that display of the decoded data on the > recipient's terminal will not cause unwanted side-effects It seems that the "quoted-word" scheme is a valid way to include a newline character in a header value, just like we already allow undecodable bytes or control characters. They do need to be properly quoted when serialized to text, though. This should fail for custom fold() implementations that aren't careful about newlines. (cherry picked from commit 0976339) This patch also contains modified commit cherry picked from c5bba85. This commit was backported to simplify the backport of the other commit fixing CVE. The only modification is a removal of one test case which tests multiple changes in Python 3.7 and it wasn't working properly with Python 3.6 where we backported only one change. Co-authored-by: Petr Viktorin <[email protected]> Co-authored-by: Bas Bloemsaat <[email protected]> Co-authored-by: Serhiy Storchaka <[email protected]> Co-authored-by: bsiem <[email protected]>
- Loading branch information
1 parent
a03f753
commit f75f869
Showing
11 changed files
with
170 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -5,6 +5,7 @@ | |
from email.message import EmailMessage | ||
from email.generator import Generator, BytesGenerator | ||
from email import policy | ||
import email.errors | ||
from test.test_email import TestEmailBase, parameterize | ||
|
||
|
||
|
@@ -215,6 +216,44 @@ def test_rfc2231_wrapping_switches_to_default_len_if_too_narrow(self): | |
g.flatten(msg) | ||
self.assertEqual(s.getvalue(), self.typ(expected)) | ||
|
||
def test_keep_encoded_newlines(self): | ||
msg = self.msgmaker(self.typ(textwrap.dedent("""\ | ||
To: nobody | ||
Subject: Bad subject=?UTF-8?Q?=0A?=Bcc: [email protected] | ||
None | ||
"""))) | ||
expected = textwrap.dedent("""\ | ||
To: nobody | ||
Subject: Bad subject=?UTF-8?Q?=0A?=Bcc: [email protected] | ||
None | ||
""") | ||
s = self.ioclass() | ||
g = self.genclass(s, policy=self.policy.clone(max_line_length=80)) | ||
g.flatten(msg) | ||
self.assertEqual(s.getvalue(), self.typ(expected)) | ||
|
||
def test_keep_long_encoded_newlines(self): | ||
msg = self.msgmaker(self.typ(textwrap.dedent("""\ | ||
To: nobody | ||
Subject: Bad subject =?UTF-8?Q?=0A?=Bcc: [email protected] | ||
None | ||
"""))) | ||
expected = textwrap.dedent("""\ | ||
To: nobody | ||
Subject: Bad subject \n\ | ||
=?utf-8?q?=0A?=Bcc: | ||
[email protected] | ||
None | ||
""") | ||
s = self.ioclass() | ||
g = self.genclass(s, policy=self.policy.clone(max_line_length=30)) | ||
g.flatten(msg) | ||
self.assertEqual(s.getvalue(), self.typ(expected)) | ||
|
||
|
||
class TestGenerator(TestGeneratorBase, TestEmailBase): | ||
|
||
|
@@ -223,6 +262,29 @@ class TestGenerator(TestGeneratorBase, TestEmailBase): | |
ioclass = io.StringIO | ||
typ = str | ||
|
||
def test_verify_generated_headers(self): | ||
"""gh-121650: by default the generator prevents header injection""" | ||
class LiteralHeader(str): | ||
name = 'Header' | ||
def fold(self, **kwargs): | ||
return self | ||
|
||
for text in ( | ||
'Value\r\nBad Injection\r\n', | ||
'NoNewLine' | ||
): | ||
with self.subTest(text=text): | ||
message = message_from_string( | ||
"Header: Value\r\n\r\nBody", | ||
policy=self.policy, | ||
) | ||
|
||
del message['Header'] | ||
message['Header'] = LiteralHeader(text) | ||
|
||
with self.assertRaises(email.errors.HeaderWriteError): | ||
message.as_string() | ||
|
||
|
||
class TestBytesGenerator(TestGeneratorBase, TestEmailBase): | ||
|
||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -1546,6 +1546,22 @@ def test_set_message_header_from_group(self): | |
|
||
class TestFolding(TestHeaderBase): | ||
|
||
def test_address_display_names(self): | ||
"""Test the folding and encoding of address headers.""" | ||
for name, result in ( | ||
('Foo Bar, France', '"Foo Bar, France"'), | ||
('Foo Bar (France)', '"Foo Bar (France)"'), | ||
('Foo Bar, España', 'Foo =?utf-8?q?Bar=2C_Espa=C3=B1a?='), | ||
('Foo Bar (España)', 'Foo Bar =?utf-8?b?KEVzcGHDsWEp?='), | ||
('Foo, Bar España', '=?utf-8?q?Foo=2C_Bar_Espa=C3=B1a?='), | ||
('Foo, Bar [España]', '=?utf-8?q?Foo=2C_Bar_=5BEspa=C3=B1a=5D?='), | ||
('Foo Bär, France', 'Foo =?utf-8?q?B=C3=A4r=2C?= France'), | ||
('Foo Bär <France>', 'Foo =?utf-8?q?B=C3=A4r_=3CFrance=3E?='), | ||
): | ||
h = self.make_header('To', Address(name, addr_spec='[email protected]')) | ||
self.assertEqual(h.fold(policy=policy.default), | ||
'To: %s <[email protected]>\n' % result) | ||
|
||
def test_short_unstructured(self): | ||
h = self.make_header('subject', 'this is a test') | ||
self.assertEqual(h.fold(policy=policy.default), | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
1 change: 1 addition & 0 deletions
1
Misc/NEWS.d/next/Library/2019-07-09-11-20-21.bpo-37482.auzvev.rst
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
Fix serialization of display name in originator or destination address fields with both encoded words and special chars. |
5 changes: 5 additions & 0 deletions
5
Misc/NEWS.d/next/Library/2024-07-27-16-10-41.gh-issue-121650.nf6oc9.rst
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,5 @@ | ||
:mod:`email` headers with embedded newlines are now quoted on output. The | ||
:mod:`~email.generator` will now refuse to serialize (write) headers that | ||
are unsafely folded or delimited; see | ||
:attr:`~email.policy.Policy.verify_generated_headers`. (Contributed by Bas | ||
Bloemsaat and Petr Viktorin in :gh:`121650`.) |