gh-145552: smtplib:`quoteaddr()` returns malformed address for input`'<'`#145553

Open

stefanzetzsche wants to merge 3 commits intopython:mainfrom

stefanzetzsche:fix/smtplib_quoteaddr_malformed

Open

gh-145552: smtplib:`quoteaddr()` returns malformed address for input`'<'`#145553
stefanzetzsche wants to merge 3 commits intopython:mainfrom
stefanzetzsche:fix/smtplib_quoteaddr_malformed

Conversation

Copy link

stefanzetzsche commentedMar 5, 2026•
edited by bedevere-appbot
Loading

Problem

quoteaddr() formats addresses for SMTPMAIL FROM: andRCPT TO: commands, which require angle-bracket format (<addr>). It first triesemail.utils.parseaddr(); when that fails (for inputs like'<','< ','@'), a fallback path checks if the input starts with< and returns it verbatim — without verifying it also ends with>.

The fallback is intentionally lenient with unparseable input (the source comment reads "use it as is and hope for the best"), but a half-open< with no> produces structurally invalid SMTP commands.

Reproducer

fromsmtplibimportquoteaddrprint(repr(quoteaddr('<')))# '<' — missing closing >

Fix

InLib/smtplib.py, in the fallback branch ofquoteaddr, verify the string also ends with> before returning it. If not, append>:

ifaddrstring.strip().startswith('<'):ifaddrstring.strip().endswith('>'):returnaddrstringreturnaddrstring.strip()+'>'

Issue:smtplib.quoteaddr() returns malformed angle-bracket address for input '<' #145552

stefanzetzscheand others added2 commits

March 5, 2026 15:03

gh-XXXXX: Fix smtplib.quoteaddr() returning malformed address for '<'

fc8b6c8

Input starting with '<' but missing closing '>' was returned verbatim.Ensure the result always ends with '>'.

test(smtplib): Add tests for quoteaddr angle-bracket handling

660ee12

Add testQuoteAddr for basic quoteaddr behavior andtestQuoteAddrMalformedAngleBracket for inputs starting with '<'but missing closing '>'. The latter fails without the fix.