mirror/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2026-01-26 12:55:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

[3.13] gh-143935: Email preserve parens when folding comments (GH-143936) (#144035)

Browse Source 
gh-143935: Email preserve parens when folding comments (GH-143936)

Fix a bug in the folding of comments when flattening an email message
using a modern email policy. Comments consisting of a very long sequence of
non-foldable characters could trigger a forced line wrap that omitted the
required leading space on the continuation line, causing the remainder of
the comment to be interpreted as a new header field. This enabled header
injection with carefully crafted inputs.
(cherry picked from commit 17d1490aa97bd6b98a42b1a9b324ead84e7fd8a2)

Co-authored-by: Seth Michael Larson <seth@python.org>
Co-authored-by: Denis Ledoux <dle@odoo.com>
This commit is contained in:
Miss Islington (bot) 2026-01-25 18:09:53 +01:00 committed by GitHub
parent 8ad828750f
commit f738386838
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 43 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
Lib/email/_header_value_parser.py
View File

@ -101,6 +101,12 @@ def make_quoted_pairs(value):
return str(value).replace('\\', '\\\\').replace('"', '\\"')
def make_parenthesis_pairs(value):
"""Escape parenthesis and backslash for use within a comment."""
return str(value).replace('\\', '\\\\') \
.replace('(', '\\(').replace(')', '\\)')
def quote_string(value):
escaped = make_quoted_pairs(value)
return f'"{escaped}"'
@ -939,7 +945,7 @@ class WhiteSpaceTerminal(Terminal):
return ' '
def startswith_fws(self):
return True
return self and self[0] in WSP
class ValueTerminal(Terminal):
@ -2959,6 +2965,13 @@ def _refold_parse_tree(parse_tree, *, policy):
[ValueTerminal(make_quoted_pairs(p), 'ptext')
for p in newparts] +
[ValueTerminal('"', 'ptext')])
if part.token_type == 'comment':
newparts = (
[ValueTerminal('(', 'ptext')] +
[ValueTerminal(make_parenthesis_pairs(p), 'ptext')
if p.token_type == 'ptext' else p
for p in newparts] +
[ValueTerminal(')', 'ptext')])
if not part.as_ew_allowed:
wrap_as_ew_blocked += 1
newparts.append(end_ew_not_allowed)

23
Lib/test/test_email/test__header_value_parser.py
View File

@ -3294,6 +3294,29 @@ class TestFolding(TestEmailBase):
with self.subTest(to=to):
self._test(parser.get_address_list(to)[0], folded, policy=policy)
def test_address_list_with_long_unwrapable_comment(self):
policy = self.policy.clone(max_line_length=40)
cases = [
# (to, folded)
('(loremipsumdolorsitametconsecteturadipi)<spy@example.org>',
'(loremipsumdolorsitametconsecteturadipi)<spy@example.org>\n'),
('<spy@example.org>(loremipsumdolorsitametconsecteturadipi)',
'<spy@example.org>(loremipsumdolorsitametconsecteturadipi)\n'),
('(loremipsum dolorsitametconsecteturadipi)<spy@example.org>',
'(loremipsum dolorsitametconsecteturadipi)<spy@example.org>\n'),
('<spy@example.org>(loremipsum dolorsitametconsecteturadipi)',
'<spy@example.org>(loremipsum\n dolorsitametconsecteturadipi)\n'),
('(Escaped \\( \\) chars \\\\ in comments stay escaped)<spy@example.org>',
'(Escaped \\( \\) chars \\\\ in comments stay\n escaped)<spy@example.org>\n'),
('((loremipsum)(loremipsum)(loremipsum)(loremipsum))<spy@example.org>',
'((loremipsum)(loremipsum)(loremipsum)(loremipsum))<spy@example.org>\n'),
('((loremipsum)(loremipsum)(loremipsum) (loremipsum))<spy@example.org>',
'((loremipsum)(loremipsum)(loremipsum)\n (loremipsum))<spy@example.org>\n'),
]
for (to, folded) in cases:
with self.subTest(to=to):
self._test(parser.get_address_list(to)[0], folded, policy=policy)
# XXX Need tests with comments on various sides of a unicode token,
# and with unicode tokens in the comments. Spaces inside the quotes
# currently don't do the right thing.

6
Misc/NEWS.d/next/Security/2026-01-16-14-40-31.gh-issue-143935.U2YtKl.rst Normal file
View File

@ -0,0 +1,6 @@
Fixed a bug in the folding of comments when flattening an email message
using a modern email policy. Comments consisting of a very long sequence of
non-foldable characters could trigger a forced line wrap that omitted the
required leading space on the continuation line, causing the remainder of
the comment to be interpreted as a new header field. This enabled header
injection with carefully crafted inputs.