NotificationsYou must be signed in to change notification settings
Fork32.1k
Star67.3k

[3.12] gh-121284: Fix email address header folding with parsed encoded-word (GH-122754)#131404

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

bitdancer merged 1 commit intopython:3.12frommiss-islington:backport-295b53d-3.12

Mar 18, 2025

Merged

[3.12] gh-121284: Fix email address header folding with parsed encoded-word (GH-122754)#131404

bitdancer merged 1 commit intopython:3.12frommiss-islington:backport-295b53d-3.12

Mar 18, 2025

Conversation

Copy link

Contributor

miss-islington commentedMar 18, 2025•
edited by bedevere-appbot
Loading

Email generators using email.policy.default may convert an RFC 2047
encoded-word to unencoded form during header refolding. In a structured
header, this could allow 'specials' chars outside a quoted-string,
leading to invalid address headers and enabling spoofing. This change
ensures a parsed encoded-word that contains specials is kept as an
encoded-word while the header is refolded.

[Better fix from@bitdancer.]

(cherry picked from commit295b53d)

Co-authored-by: Mike Edmundsmedmunds@gmail.com
Co-authored-by: R David Murrayrdmurray@bitdance.com
Co-authored-by: Petr Viktorinencukou@gmail.com

Issue:email: invalid RFC 2047 address header after refolding with email.policy.default #121284

pythongh-121284: Fix email address header folding with parsed encoded…

88af7b8

…-word (pythonGH-122754)Email generators using email.policy.default may convert an RFC 2047encoded-word to unencoded form during header refolding. In a structuredheader, this could allow 'specials' chars outside a quoted-string,leading to invalid address headers and enabling spoofing. This changeensures a parsed encoded-word that contains specials is kept as anencoded-word while the header is refolded.[Better fix from@bitdancer.]---------(cherry picked from commit295b53d)Co-authored-by: Mike Edmunds <medmunds@gmail.com>Co-authored-by: R David Murray <rdmurray@bitdance.com>Co-authored-by: Petr Viktorin <encukou@gmail.com>