Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

gh-102988: Detect email address parsing errors and return empty tuple to indicate the parsing error (old API)#105127

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
gpshead merged 9 commits intopython:mainfromtdwyer:fix_issues102988
Jul 10, 2023

Conversation

tdwyer
Copy link
Contributor

@tdwyertdwyer commentedMay 31, 2023•
edited by bedevere-bot
Loading

This PR is designed to detect parsing errors and return an empty tuple to indicate the parsing error. Additionally, this PR updates thetest_email.py to check for these bugs, as well as, adds some other wacky Address Headers that are in the examples of RFC 2822 and makes sure they are being parsed correctly.

I realize that this PR dose not actually track down the bug and fix it. It simply detects the error has happened and returns a parsing error. However,Lib/email/utils.py is a much simpler file thanLib/email/_parseaddr.py, so it is much easier to review this change. Additionally, there are actually multiple bugs which are causing erroneous output. Tracing the code flow for each and fixing them would be prone to error considering all of the wacky stuff that RFC 2822 allows for in Address headers. Finally, this change is actually rather simple.

… tuple to indicate the parsing error (old API)
@bedevere-bot
Copy link

Most changes to Pythonrequire a NEWS entry.

Please add it using theblurb_it web app or theblurb command-line tool.

@tdwyer
Copy link
ContributorAuthor

I had to create a new PR to replace the last one because Git got all messed up.

This is the old PR:#102990

@tdwyertdwyer changed the titlegh-102988: Detect email address parsing errors and return empty tupleto indicate the parsing error (old API)gh-102988: Detect email address parsing errors and return empty tuple to indicate the parsing error (old API)May 31, 2023
@bedevere-bot
Copy link

Most changes to Pythonrequire a NEWS entry.

Please add it using theblurb_it web app or theblurb command-line tool.

@bedevere-bot

This comment was marked as duplicate.

@bedevere-bot

This comment was marked as duplicate.

@tdwyer
Copy link
ContributorAuthor

Hum... it looks likeCVE-2019-16056 was only fixed forparseaddr() and notgetaddresses(). This PR happens to fix that too.
https://www.cve.org/CVERecord?id=CVE-2019-16056

getaddresses()

a = ['a@b.com<z@x.com>']getaddresses(a)[('', 'a@b.com'), ('', 'z@x.com')]

parseaddr()

a = ['a@b.com<z@x.com>']parseaddr(a)('', 'a@b.com<z@x.com>')
gpshead reacted with laugh emojigpshead reacted with hooray emoji

@tdwyer
Copy link
ContributorAuthor

Should I add that NEWS entry that the Bot is asking for?

@CharlieZhao95
Copy link
Contributor

Should I add that NEWS entry that the Bot is asking for?

I think it is needed, NEWS entry is required for most code modifications 😄. Please see:https://devguide.python.org/core-developers/committing/#updating-news-and-what-s-new-in-python

tdwyer reacted with thumbs up emoji

@tdwyer
Copy link
ContributorAuthor

I added NEWS entry, and all Unit tests have passed.

@tdwyer

This comment was marked as resolved.

@CharlieZhao95

This comment was marked as resolved.

@gpshead

This comment was marked as resolved.

@zhuofeng6

This comment was marked as spam.

@gpsheadgpshead added the type-securityA security issue labelJul 10, 2023
@gpshead
Copy link
Member

Docs updated, auto-merge set. The backports beyond 3.12 will require manual work to get version numbered things right. I'd like to let this bake in 3.12beta4 & 3.12rc1 for a while first to see if any practical issues arise before landing the backports in older releases.

it is a security issue so we could backport it all the way to 3.8, but lets see how things go first. it is not high severity.

CharlieZhao95 and phbno1 reacted with hooray emoji

@gpsheadgpshead merged commit18dfbd0 intopython:mainJul 10, 2023
@miss-islington
Copy link
Contributor

Thanks@tdwyer for the PR, and@gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12.
🐍🍒⛏🤖

@miss-islington
Copy link
Contributor

Sorry,@tdwyer and@gpshead, I could not cleanly backport this to3.11 due to a conflict.
Please backport usingcherry_picker on command line.
cherry_picker 18dfbd035775c15533d13a98e56b1d2bf5c65f00 3.11

miss-islington pushed a commit to miss-islington/cpython that referenced this pull requestJul 10, 2023
… tuple to indicate the parsing error (old API) (pythonGH-105127)Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). This fixes or at least amelioratesCVE-2023-27043.---------(cherry picked from commit18dfbd0)Co-authored-by: Thomas Dwyer <github@tomd.tel>Co-authored-by: Gregory P. Smith <greg@krypto.org>
@miss-islington
Copy link
Contributor

Sorry@tdwyer and@gpshead, I had trouble checking out the3.10 backport branch.
Please retry by removing and re-adding the "needs backport to 3.10" label.
Alternatively, you can backport usingcherry_picker on the command line.
cherry_picker 18dfbd035775c15533d13a98e56b1d2bf5c65f00 3.10

@bedevere-bot
Copy link

GH-106612 is a backport of this pull request to the3.12 branch.

@bedevere-botbedevere-bot removed the needs backport to 3.12only security fixes labelJul 10, 2023
gpshead added a commit that referenced this pull requestJul 10, 2023
…y tuple to indicate the parsing error (old API) (GH-105127) (#106612)gh-102988: Detect email address parsing errors and return empty tuple to indicate the parsing error (old API) (GH-105127)Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). This fixes or at least amelioratesCVE-2023-27043.---------(cherry picked from commit18dfbd0)Co-authored-by: Thomas Dwyer <github@tomd.tel>Co-authored-by: Gregory P. Smith <greg@krypto.org>
@tdwyer-wish
Copy link

tdwyer-wish commentedJul 12, 2023•
edited
Loading

Hello@gpshead Are you going to take care of the backports/cherrypick for 3.10 and 3.11 I'd do them but I've never done that before... Hum, actually I don't think I have permission to do that.

@gpshead
Copy link
Member

i'll do them, the issue remains assigned to me as a reminder. (anyonecan do it, it's just a matter of creating your PR as a fork of the relevant release branch and selecting the matching base branch in the github ui at pr creation time)

tdwyer-wish reacted with thumbs up emoji

@CharlieZhao95
Copy link
Contributor

Hello@gpshead Are you going to take care of the backports/cherrypick for 3.10 and 3.11 I'd do them but I've never done that before... Hum, actually I don't think I have permission to do that.

Please seehttps://devguide.python.org/core-developers/committing/#backporting-changes-to-an-older-version for details.

@gpshead
Copy link
Member

this appears to have caused#106669

rouilj reacted with confused emoji

@@ -87,7 +92,7 @@ of the new API.
This method returns a list of 2-tuples of the form returned by ``parseaddr()``.
*fieldvalues* is a sequence of header field values as might be returned by
:meth:`Message.get_all <email.message.Message.get_all>`. Here's a simple
example that gets all the recipients of a message::
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

@tdwyer Is this right? Isn’t the next paragraph still a literal block? Why have you removed this colon?

AlexWaygood reacted with thumbs up emojitdwyer-wish reacted with eyes emoji
gpshead added a commit to gpshead/cpython that referenced this pull requestJul 14, 2023
…g errors and return empty tuple to indicate the parsing error (old API) (python#105127)"This reverts commit18dfbd0.Seepython#106669.
gpshead added a commit that referenced this pull requestJul 21, 2023
gpshead added a commit to gpshead/cpython that referenced this pull requestJul 21, 2023
… parsing errors ... (pythonGH-105127)" (pythonGH-106733)This reverts commit18dfbd0.Adds a regression test from the issue.Seepython#106669..(cherry picked from commita31dea1)Co-authored-by: Gregory P. Smith <greg@krypto.org>
gpshead added a commit that referenced this pull requestJul 21, 2023
…ors ... (GH-105127)" (GH-106733) (#106941)This reverts commit18dfbd0.Adds a regression test from the issue.See#106669..(cherry picked from commita31dea1)
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Reviewers

@mceplmceplmcepl left review comments

@gpsheadgpsheadgpshead approved these changes

@CharlieZhao95CharlieZhao95Awaiting requested review from CharlieZhao95

Assignees

@gpsheadgpshead

Labels
needs backport to 3.10only security fixesneeds backport to 3.11only security fixestype-securityA security issue
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

8 participants
@tdwyer@bedevere-bot@CharlieZhao95@gpshead@zhuofeng6@miss-islington@tdwyer-wish@mcepl
[8]ページ先頭
©2009-2025 Movatter.jp