NotificationsYou must be signed in to change notification settings
Fork32.4k
Star67.9k

[3.8] gh-121650: Encode newlines in headers, and verify headers are sound (GH-122233)#122611

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

ambv merged 4 commits intopython:3.8fromambv:backport-0976339-3.8

Sep 4, 2024

Merged

[3.8] gh-121650: Encode newlines in headers, and verify headers are sound (GH-122233)#122611

ambv merged 4 commits intopython:3.8fromambv:backport-0976339-3.8

Sep 4, 2024

Conversation

Copy link

Contributor

ambv commentedAug 2, 2024•
edited by bedevere-appbot
Loading

Per RFC 2047:

[...] these encoding schemes allow the
encoding of arbitrary octet values, mail readers that implement this
decoding should also ensure that display of the decoded data on the
recipient's terminal will not cause unwanted side-effects

It seems that the "quoted-word" scheme is a valid way to include a newline character in a header value, just like we already allow undecodable bytes or control characters.
They do need to be properly quoted when serialized to text, though.

This should fail for custom fold() implementations that aren't careful about newlines.

(cherry picked from commit0976339)

Issue:email.policy.default - gotcha with re-using parsed headers with embedded newlines #121650

[3.8]pythongh-121650: Encode newlines in headers, and verify headers…

d7cf62c

… are sound (pythonGH-122233)Per RFC 2047:> [...] these encoding schemes allow the> encoding of arbitrary octet values, mail readers that implement this> decoding should also ensure that display of the decoded data on the> recipient's terminal will not cause unwanted side-effectsIt seems that the "quoted-word" scheme is a valid way to includea newline character in a header value, just like we already allowundecodable bytes or control characters.They do need to be properly quoted when serialized to text, though.This should fail for custom fold() implementations that aren't carefulabout newlines.(cherry picked from commit0976339)Co-authored-by: Petr Viktorin <encukou@gmail.com>Co-authored-by: Bas Bloemsaat <bas@bloemsaat.org>Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

ambv requested a review froma team as acode owner

August 2, 2024 13:19

This was referencedAug 2, 2024

email.policy.default - gotcha with re-using parsed headers with embedded newlines#121650

Closed

gh-121650: Encode newlines in headers, and verify headers are sound#122233

Merged

bedevere-appbot added the awaiting core review label

Aug 2, 2024

ambv added3 commits

August 2, 2024 15:25

s/3.9.20/3.8.20/

7725541

Removeremovesuffix

c42cbdc

Fix ReST mishap

3ff1c23

Copy link

Member

vstinner commentedSep 2, 2024

Sadly, the build fails on macOS:

checking for gcc... clangchecking whether the C compiler works... noconfigure: error: in `/Users/runner/work/cpython/cpython':configure: error: C compiler cannot create executablesSee `config.log' for more details

vstinner approved these changes

Sep 2, 2024

View reviewed changes

Copy link

Member

vstinner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

LGTM: straightforward backport and the change is properly documented as.. versionadded:: 3.8.20 with "Notable changes in 3.8.20" in What's New in Python 3.8. I compared this 3.8 change to the change in the main branch.