GeezerVison

This does not check )( or any other combination when ) proceeds (. Probably it could be better to iterate through the string and manually increment and decrement verifying that the counter never goes below 0 and it is exactly 0 at the end

Looks like this is not necessary. The fix already accounts for this and none of those are an issue.

My current solution works, because instead of trying to actually parse things I just detect an error has occurred by making sure that the resulting number of address 2-Tuples matches the number of Headers that were parsed. Which is why I went this direction. It's super hard to fix the actual parsing logic of RFC 2822 headers :P

./python
Python 3.13.0a0 (heads/blah_1:a1cc74c4ee, Aug 21 2023, 18:40:57) [GCC 7.5.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> 
>>> from email.utils import parseaddr, getaddresses
>>> 
>>> 
>>> parseaddr('[email protected]])(<[email protected]>')
('', '')
>>> 
>>> parseaddr('[email protected])(<[email protected]>')
('', '')
>>> 
>>> parseaddr('[email protected] <[email protected]>')
('', '')
>>> parseaddr('[email protected]..<[email protected]>')
('', '')
>>> 
>>> getaddresses(['[email protected]..<[email protected]>'])
[('', '')]
>>> 
>>> getaddresses(['[email protected]])(<[email protected]>'])
[('', '')]
>>> 
>>> getaddresses(['[email protected])(<[email protected]>'])
[('', '')]

With the un-patched python your attack results in multiple Tuples being returned

>>> getaddresses(['[email protected]])(<[email protected]>'])
[('', '[email protected]'), ('', ''), ('', '')]

A cleaner way to say it is this. There are countless ways to trigger this parsing error but there is only one error e.g. the parser will return an abnormal number of output tuples. So, rather than trying to detect every possible input which could trigger the bug, I just detect the one error that they all result in.

After looking at this again, it is interesting that my solution works here… why do I check for matching parentheses at all ?

[email protected])(<bob&@example.com

I have ideas, but I’ll look into it.

Does this regex support multiple commas inside quotes?

The regex works for multiple commas because the Not-In-List [^"] allows for other commas. There just simply has to be at least one comma in between the Quotes.

I'm just curious. The regex proposed by me simply ignores whatever is in single or double quotes and seems to be much simpler than this one. Is there any benefit in ignoring only the quoted parts containing at least one comma? I think it has no effect on the comma-counting logic.

@frenzymadness I don't see your suggested regex. In any case, perhaps what you are suggesting would be fine. I'll think on it. However, from a security perspective I'd like to be as specific as possible, because things get super tricky and I'd not want to implement a fix that is latter proven to be able to be bypassed. It's only the commas in quotes that are an issue here and should be accounted for.

In ether case, I plan on at least implementing the Triple Single-Quote syntax so I don't need to escape the single-quotes.

Additionally, I want looks some more to make sure that single-quotes are valid chars to isolate the Real Name part of the header. It's looking like only Double-Quotes to that, if so then only commas in Double-Quotes should be stripped.

The regex has been proposed in this comment: #102988 (comment)

Okay, I'll consider that. I've been busy with work but I plan on adding the extra test_email.py and updating the regex over this weekend.

However, not a bad idea to add extra tests. That way if someone else changes this code in the future these other corner cases will be tested for.