GeezerVisonThe World Wide Web, restored to 800 pixels of glory. |
| Home|About|Gaming cabinet|Archives|How it works|Starter sites |
GeezerVison is showing github.com — Email's as_bytes() method unfolds a protected header in a pgp signed message part breaking the signature. · Issue #153822 · python/cpython Open Labels stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directorytopic-emailtype-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error DescriptionBug reportBug description:>>> from email import parser, policy >>> # Create a bytes parser with default policy >>> parser = parser.BytesParser(policy=policy.default) >>> # Set bytes to the raw message content. Note the In-Reply-To header is folded in both the outer message >>> # and in the proctected headers in the signed text/plain part. >>> bytes = b"""In-Reply-To: ... <CAMFngpXc_66qL0nUkHtT5g98BhWHPE8-KFtc6=87OvA-U7O9cw@mail.gmail.com> ... MIME-Version: 1.0 ... Content-Type: multipart/signed; boundary="nextPartVzbFsyfPQFC9aKXYcHllLg"; ... micalg="pgp-sha512"; protocol="application/pgp-signature" ... ... --nextPartVzbFsyfPQFC9aKXYcHllLg ... Content-Transfer-Encoding: 7Bit ... Content-Type: text/plain; charset="utf-8"; protected-headers="v1" ... In-Reply-To: ... <CAMFngpXc_66qL0nUkHtT5g98BhWHPE8-KFtc6=87OvA-U7O9cw@mail.gmail.com> ... MIME-Version: 1.0 ... ... fake message here ... --nextPartVzbFsyfPQFC9aKXYcHllLg ... Content-Type: application/pgp-signature; name="signature.asc" ... Content-Description: This is a digitally signed message part. ... Content-Transfer-Encoding: 7Bit ... ... -----BEGIN PGP SIGNATURE----- ... ... iJEEABYKADkWIQRIePpI7xqJT+Ra2G9Prbu26Vsl/AUCalfydhsUgAAAAAAEAA5t ... YW51MiwyLjUrMS4xMiwyLDIACgkQT627tulbJfzupAD/a1gphNvf7nc+sYph/EJi ... W61+Kg356YYzRXS7SsfFI14A/2z4u28/Chqd/ETNh4VRYfl4Rf8N7eDMpFOZSEdM ... bTkF ... =QWJd ... -----END PGP SIGNATURE----- ... ... --nextPartVzbFsyfPQFC9aKXYcHllLg-- ... """ >>> # Create a message object. >>> msg = parser.parsebytes(bytes) >>> # and print its as_bytes() representation. >>> print(msg.as_bytes().decode()) In-Reply-To: <CAMFngpXc_66qL0nUkHtT5g98BhWHPE8-KFtc6=87OvA-U7O9cw@mail.gmail.com> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPartVzbFsyfPQFC9aKXYcHllLg"; micalg="pgp-sha512"; protocol="application/pgp-signature" --nextPartVzbFsyfPQFC9aKXYcHllLg Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="utf-8"; protected-headers="v1" In-Reply-To: <CAMFngpXc_66qL0nUkHtT5g98BhWHPE8-KFtc6=87OvA-U7O9cw@mail.gmail.com> MIME-Version: 1.0 fake message here --nextPartVzbFsyfPQFC9aKXYcHllLg Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part. Content-Transfer-Encoding: 7Bit -----BEGIN PGP SIGNATURE----- iJEEABYKADkWIQRIePpI7xqJT+Ra2G9Prbu26Vsl/AUCalfydhsUgAAAAAAEAA5t YW51MiwyLjUrMS4xMiwyLDIACgkQT627tulbJfzupAD/a1gphNvf7nc+sYph/EJi W61+Kg356YYzRXS7SsfFI14A/2z4u28/Chqd/ETNh4VRYfl4Rf8N7eDMpFOZSEdM bTkF =QWJd -----END PGP SIGNATURE----- --nextPartVzbFsyfPQFC9aKXYcHllLg-- >>> # Note that the protected In-Reply-To header in the signed text/plain part is unfolded even though it is >>> # 81 bytes long. >>> # Now get only the text/plain part. >>> part = msg.get_payload(0) >>> # And see it as_bytes(). >>> print(part.as_bytes().decode()) Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="utf-8"; protected-headers="v1" In-Reply-To: <CAMFngpXc_66qL0nUkHtT5g98BhWHPE8-KFtc6=87OvA-U7O9cw@mail.gmail.com> MIME-Version: 1.0 fake message here >>> # And here the header is properly folded. The problem here is if a message of which the above is an excerpt is received by some application, e.g. Mailman, and later resent to recipients by passing the message object to Python's smtplib.SMTP.send_message() method which serializes the message with the as_bytes() method applied to the whole message, the resent message has the unfolded protected In-Reply-To header in the signed part breaking the signature. CPython versions tested on:3.13 Operating systems tested on:Linux Linked PRsActivity
MetadataMetadataAssigneesLabelsstdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directorytopic-emailtype-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error ProjectsMilestoneRelationshipsDevelopmentIssue actions |
| You are visitor 01402520 — GeezerVison does not store the pages you look up. Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required. |