GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Email's as_bytes() method unfolds a protected header in a pgp signed message part breaking the signature. · Issue #153822 · python/cpython

Email's as_bytes() method unfolds a protected header in a pgp signed message part breaking the signature. #153822

New issue
Copy link
New issue
Copy link
Open
Open
Email's as_bytes() method unfolds a protected header in a pgp signed message part breaking the signature.#153822
Copy link
Labels
stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directorytopic-emailtype-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

Description

@msapiro
msapiro
opened on Jul 16, 2026
Issue body actions

Bug report

Bug description:

>>> from email import parser, policy
>>> # Create a bytes parser with default policy
>>> parser = parser.BytesParser(policy=policy.default)
>>> # Set bytes to the raw message content. Note the In-Reply-To header is folded in both the outer message
>>> # and in the proctected headers in the signed text/plain part.
>>> bytes = b"""In-Reply-To:
...  <CAMFngpXc_66qL0nUkHtT5g98BhWHPE8-KFtc6=87OvA-U7O9cw@mail.gmail.com>
... MIME-Version: 1.0
... Content-Type: multipart/signed; boundary="nextPartVzbFsyfPQFC9aKXYcHllLg";
...  micalg="pgp-sha512"; protocol="application/pgp-signature"
... 
... --nextPartVzbFsyfPQFC9aKXYcHllLg
... Content-Transfer-Encoding: 7Bit
... Content-Type: text/plain; charset="utf-8"; protected-headers="v1"
... In-Reply-To:
...  <CAMFngpXc_66qL0nUkHtT5g98BhWHPE8-KFtc6=87OvA-U7O9cw@mail.gmail.com>
... MIME-Version: 1.0
... 
... fake message here
... --nextPartVzbFsyfPQFC9aKXYcHllLg
... Content-Type: application/pgp-signature; name="signature.asc"
... Content-Description: This is a digitally signed message part.
... Content-Transfer-Encoding: 7Bit
... 
... -----BEGIN PGP SIGNATURE-----
... 
... iJEEABYKADkWIQRIePpI7xqJT+Ra2G9Prbu26Vsl/AUCalfydhsUgAAAAAAEAA5t
... YW51MiwyLjUrMS4xMiwyLDIACgkQT627tulbJfzupAD/a1gphNvf7nc+sYph/EJi
... W61+Kg356YYzRXS7SsfFI14A/2z4u28/Chqd/ETNh4VRYfl4Rf8N7eDMpFOZSEdM
... bTkF
... =QWJd
... -----END PGP SIGNATURE-----
... 
... --nextPartVzbFsyfPQFC9aKXYcHllLg--
... """
>>> # Create a message object.
>>> msg = parser.parsebytes(bytes)
>>> # and print its as_bytes() representation.
>>> print(msg.as_bytes().decode())
In-Reply-To:
 <CAMFngpXc_66qL0nUkHtT5g98BhWHPE8-KFtc6=87OvA-U7O9cw@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="nextPartVzbFsyfPQFC9aKXYcHllLg";
 micalg="pgp-sha512"; protocol="application/pgp-signature"

--nextPartVzbFsyfPQFC9aKXYcHllLg
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="utf-8"; protected-headers="v1"
In-Reply-To: <CAMFngpXc_66qL0nUkHtT5g98BhWHPE8-KFtc6=87OvA-U7O9cw@mail.gmail.com>
MIME-Version: 1.0

fake message here
--nextPartVzbFsyfPQFC9aKXYcHllLg
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part.
Content-Transfer-Encoding: 7Bit

-----BEGIN PGP SIGNATURE-----

iJEEABYKADkWIQRIePpI7xqJT+Ra2G9Prbu26Vsl/AUCalfydhsUgAAAAAAEAA5t
YW51MiwyLjUrMS4xMiwyLDIACgkQT627tulbJfzupAD/a1gphNvf7nc+sYph/EJi
W61+Kg356YYzRXS7SsfFI14A/2z4u28/Chqd/ETNh4VRYfl4Rf8N7eDMpFOZSEdM
bTkF
=QWJd
-----END PGP SIGNATURE-----

--nextPartVzbFsyfPQFC9aKXYcHllLg--

>>> # Note that the protected In-Reply-To header in the signed text/plain part is unfolded even though it is
>>> # 81 bytes long.
>>> # Now get only the text/plain part.
>>> part = msg.get_payload(0)
>>> # And see it as_bytes().
>>> print(part.as_bytes().decode())
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="utf-8"; protected-headers="v1"
In-Reply-To:
 <CAMFngpXc_66qL0nUkHtT5g98BhWHPE8-KFtc6=87OvA-U7O9cw@mail.gmail.com>
MIME-Version: 1.0

fake message here
>>> # And here the header is properly folded.

The problem here is if a message of which the above is an excerpt is received by some application, e.g. Mailman, and later resent to recipients by passing the message object to Python's smtplib.SMTP.send_message() method which serializes the message with the as_bytes() method applied to the whole message, the resent message has the unfolded protected In-Reply-To header in the signed part breaking the signature.

CPython versions tested on:

3.13

Operating systems tested on:

Linux

Linked PRs

  • gh-153822: Recreate the headers from raw form when part of signed data #154107

Activity

  1. msapiro
    added
    type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error
    on Jul 16, 2026
  2. picnixz
    added
    stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory
    topic-email
    on Jul 18, 2026
  3. MichalKarol
    added 3 commits that reference this issue on Jul 19, 2026

    Merge branch 'main' into pythongh-153822-keep-raw-header-values-when-…

    5ea863a

    Merge branch 'python:main' into pythongh-153822-keep-raw-header-value…

    09e7c8c

    Merge branch 'main' into pythongh-153822-keep-raw-header-values-when-…

    a9aac53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directorytopic-emailtype-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions

      You are visitor 01402520 — GeezerVison does not store the pages you look up.
      Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.