Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork32.4k
Description
Bug report
Bug description:
I'm not sure if this is a bug, feature request, or user error. I'm happy to re-file once I know which
If a parsed email header contains a correctly quoted newline, setting an email header to that value will include a newline.
fromemailimportmessage_from_stringfromemail.policyimportdefaultemail_in="""\To: incoming+tag@me.example.comFrom: External Sender <sender@them.example.com>Subject: Here's an =?UTF-8?Q?embedded_newline=0A?=Content-Type: text/html; charset=UTF-8Content-Transfer-Encoding: quoted-printableMIME-Version: 1.0<html><head><title>An embeded newline</title></head><body> <p>I sent you an embedded newline in the subject. How do you like that?!</p></body></html>"""msg=message_from_string(email_in,policy=default)msg=message_from_string(email_in,policy=default)forheader,valueinmsg.items():delmsg[header]msg[header]=valueemail_out=str(msg)print(email_out)
Output is:
To:incoming+tag@me.example.comFrom: ExternalSender <sender@them.example.com>Subject: Here's an embedded newlineContent-Type:text/html; charset="UTF-8"Content-Transfer-Encoding: quoted-printableMIME-Version: 1.0<html><head><title>An embeded newline</title></head><body> <p>I sent you an embedded newline in the subject. How do you like that?!</p></body></html>
An email parser will interpret the newline as the start of the message. In this case, theContent-Type and other MIME headers will not be processed, and the email treated as plain text. In other cases, required headers likeTo may not be processed and the email will not be delivered.
I'd expect an error on setting the value, an error on serializing theEmailMessage to a string, the subject to retain the original encoding, or the newline to be quoted in the serialized version.
Now that we know the behavior, we can process the headers (embed or strip trailing newlines). However, you may see this is a bug, a needed feature, or missing documentation.
More info:
subject's type is aemail.headerregistry._UniqueUnstructuredHeader. It has aname, so it is assigned without checking (email.policy.EmailPolicy.header_store_parse()).
The_parse_tree, returned byemail._header_value_parser.get_unstructured(), is:
UnstructuredTokenList([ValueTerminal("Here's"), WhiteSpaceTerminal(' '), ValueTerminal('an'), WhiteSpaceTerminal(' '), EncodedWord([ValueTerminal('embedded'), WhiteSpaceTerminal(' '), ValueTerminal('newline\n')])])A user encountered this for our email relaying servicehttps://relay.firefox.com (mozilla/fx-private-relay#4841). An incoming email to a service address is matched to a user. We re-write the email headers and forward the email to the user's "real" address.
A real email has this subject header:
Subject: The All Over Piercings Wishlist of =?UTF-8?Q?John=2E=0A?=This is from a European websitehttps://www.alloverpiercings.com. You can create a wishlist and send it to an email address. The subject appears correctly encoded to me, to allow for non-ASCII usernames, with the unfortunate embedded newline. When forwarding this email, using something similar to the code above (but with more header modifications and additions), the embedded newline is turned into a real newline. The rest of the email headers are treated as part of the body. Since theContent-Type and other MIME headers are not processed as headers, the email is treated as a plain text email.
CPython versions tested on:
3.11, 3.12
Operating systems tested on:
macOS
Linked PRs
- gh-121650 : detect newlines in headers #121812
- gh-121650: Encode newlines in headers, and verify headers are sound #122233
- [3.13] gh-121650: Encode newlines in headers, and verify headers are sound (GH-122233) #122484
- [3.12] gh-121650: Encode newlines in headers, and verify headers are sound (GH-122233) #122599
- [3.11] gh-121650: Encode newlines in headers, and verify headers are sound (GH-122233) #122608
- [3.10] gh-121650: Encode newlines in headers, and verify headers are sound (GH-122233) #122609
- [3.9] gh-121650: Encode newlines in headers, and verify headers are sound (GH-122233) #122610
- [3.8] gh-121650: Encode newlines in headers, and verify headers are sound (GH-122233) #122611