Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork32.1k
[3.10] gh-80222: Fix email address header folding with long quoted-string (GH-122753)#129111
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Uh oh!
There was an error while loading.Please reload this page.
Conversation
@bitdancer The CI is failing for |
bitdancer is no longer active. @python/email-team Security backport is pending fix of failing test. |
The failing test_address_list_with_list_separator_after_fold was added in 3.11 by PRs#100885 and#119099 as a fix forgh-100884 (and regressiongh-118643). The test case is being pulled into 3.10 by this backport, but without the corresponding fix. gh-100884 has similar security implications to the original issue here, but was not identified as a security issue at the time. (It's also effectively the inverse issue ofgh-121284.) |
@terryjreedy Actually I'm becoming active again, but I'm still ramping back up. I'm still learning about the current way backports are done, and it has taken me a while to get back to this. |
…ted-string (pythonGH-122753)Email generators using email.policy.default could incorrectly omit thequote ('"') characters from a quoted-string during header refolding,leading to invalid address headers and enabling header spoofing. Thischange restores the quote characters on a bare-quoted-string as theheader is refolded, and escapes backslash and quote chars in the string.(cherry picked from commit5aaf416)Co-authored-by: Mike Edmunds <medmunds@gmail.com>
54443ce tof35f5c0CompareTests are passing now. |
a4ef689 intopython:3.10Uh oh!
There was an error while loading.Please reload this page.
GH-132371 is a backport of this pull request to the3.9 branch. |
@bitdancer Good to see you back ;-). Are you aware of core-dev discord? |
@terryjreedy Aware, yes, but I haven't gotten around to trying to figure out how to access it ;) |
@bitdancer I've sent an invite to the email on your profile. Welcome! |
…ing (GH-122753) (GH-129111) (GH-132371)Email generators using email.policy.default could incorrectly omit thequote ('"') characters from a quoted-string during header refolding,leading to invalid address headers and enabling header spoofing. Thischange restores the quote characters on a bare-quoted-string as theheader is refolded, and escapes backslash and quote chars in the string.(cherry picked from commit5aaf416)(cherry picked from commita4ef689)Co-authored-by: R. David Murray <rdmurray@bitdance.com>Co-authored-by: Mike Edmunds <medmunds@gmail.com>Co-authored-by: Łukasz Langa <lukasz@langa.pl>
Uh oh!
There was an error while loading.Please reload this page.
Email generators using email.policy.default could incorrectly omit the
quote ('"') characters from a quoted-string during header refolding,
leading to invalid address headers and enabling header spoofing. This
change restores the quote characters on a bare-quoted-string as the
header is refolded, and escapes backslash and quote chars in the string.
(cherry picked from commit5aaf416)
Co-authored-by: Mike Edmundsmedmunds@gmail.com