GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-121650: Encode newlines in headers, and verify headers are sound by encukou · Pull Request #122233 · python/cpython

Conversation

@encukou

@encukou encukou commented Jul 24, 2024 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

Re: #121812

Hello @basbloemsaat,

I've spent the day reading through the email module, and RFCs, and I believe I found a better place to fix the issue.
This involved lots of experimentation, so I'm sending an alternative PR rather than a review on yours.

  • The generator (writer) verifies that the representation of each header is sound (a parser won't treat it as multiple headers, start-of-body, or part of another header). That should cover custom fold() implementations or Header subclasses.

    • However, some user out there is probably misusing such header injection in working code, so, I added a policy attribute to turn it back.

  • Newlines are encoded in fold(), just like undecodable bytes and other special characters.

Overall, this means that we treat newlines as valid content of headers, but “escape” them when such a header is serialized to text.

This PR is a proof of concept. It needs tests and documentation, but I'm out of time for today, and I wanted to share what I have.

Does this look reasonable to you?

  • Issue: email.policy.default - gotcha with re-using parsed headers with embedded newlines #121650

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
encukou and others added 2 commits July 24, 2024 15:30
@encukou
Verify that email headers are well-formed
921cbfd 
This should fail for custom fold() implementations that aren't careful
about newlines.
@encukou @basbloemsaat
Encode header parts that contain newlines
bd7f922 
Per RFC 2047:

> [...] these encoding schemes allow the
> encoding of arbitrary octet values, mail readers that implement this
> decoding should also ensure that display of the decoded data on the
> recipient's terminal will not cause unwanted side-effects

It seems that the "quoted-word" scheme is a valid way to include
a newline character in a header value, just like we already allow
undecodable bytes or control characters.
They do need to be properly quoted when serialized to text, though.

---

Credit for an earlier attempt:

Co-Authored-By: Bas Bloemsaat <[email protected]>
@encukou
encukou requested a review from serhiy-storchaka July 24, 2024 13:55
@bedevere-app bedevere-app Bot mentioned this pull request Jul 24, 2024
email.policy.default - gotcha with re-using parsed headers with embedded newlines #121650
Closed
@encukou encukou mentioned this pull request Jul 24, 2024
gh-121650 : detect newlines in headers #121812
Closed
@basbloemsaat

basbloemsaat commented Jul 25, 2024

Copy link
Copy Markdown
Contributor

That sounds entirely reasonable, and conforms to the RFCs.

Two points:

  1. what would be the use of keeping this check in email.policy.header_store_parse ?
  2. I found one case that is not covered by this (contrived, I admit):
from email import message_from_string

email_in = """
Subject: foo <bar>\nBCC: [email protected]
To: [email protected]
From: External Sender <[email protected]>

message body
"""

msg = message_from_string(email_in)
print(msg)
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@encukou

encukou commented Jul 27, 2024

Copy link
Copy Markdown
Member Author

what would be the use of keeping this check in email.policy.header_store_parse ?

This is in the branch that handles strings (rather than custom Header object). I'm not clears what kind of format that string is supposed to be in.
Keeping the check means that if someone relied on this, they'll get the same error as before. Also, the indication that something is wrong will come earlier.

I found one case that is not covered by this (contrived, I admit)

That \n there is Python syntax, by the time it gets to message_from_string it's the same as a “real” newline.
If you use a raw string r""", or read from a file, the header remains on a single line.
basbloemsaat reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@encukou
Add tests and documentation
59c06c3
@encukou encukou added needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes labels Jul 27, 2024
encukou added 3 commits July 27, 2024 16:10
@encukou
Add a blurb
8e7d6f1
@encukou
Add the news to 3.13; there's still hope for backporting
ef65562
@encukou
Don't mark up True
64dcb44 
I'm not touching other instances in this file, since this PR might
be backported to very old versions.
@encukou
encukou marked this pull request as ready for review July 29, 2024 13:18
@encukou
encukou requested a review from a team as a code owner July 29, 2024 13:18
@bedevere-app bedevere-app Bot added the awaiting core review label Jul 29, 2024
@encukou
Document HeaderWriteError
af41733
@encukou

encukou commented Jul 29, 2024

Copy link
Copy Markdown
Member Author

@serhiy-storchaka, would you like to review this?
@warsaw, @bitdancer, @maxking, as email experts, do you have any comments?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@encukou encukou added needs backport to 3.8 needs backport to 3.11 only security fixes 🔨 test-with-buildbots Test PR w/ buildbots; report in status section labels Jul 29, 2024
@bedevere-bot

bedevere-bot commented Jul 29, 2024

Copy link
Copy Markdown

🤖 New build scheduled with the buildbot fleet by @encukou for commit af41733 🤖

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot bedevere-bot removed the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Jul 29, 2024
serhiy-storchaka
serhiy-storchaka approved these changes Jul 30, 2024
View reviewed changes

@serhiy-storchaka serhiy-storchaka left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread Lib/email/_header_value_parser.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread Lib/test/test_email/test_policy.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting core review labels Jul 30, 2024
@encukou @serhiy-storchaka
Apply suggestions from code review
596a25b 
Co-authored-by: Serhiy Storchaka <[email protected]>
serhiy-storchaka
serhiy-storchaka approved these changes Jul 30, 2024
View reviewed changes
ambv pushed a commit to ambv/cpython that referenced this pull request Aug 2, 2024
@encukou @basbloemsaat
@serhiy-storchaka @ambv
[3.8] pythongh-121650: Encode newlines in headers, and verify headers…
d7cf62c 
… are sound (pythonGH-122233)

Per RFC 2047:

> [...] these encoding schemes allow the
> encoding of arbitrary octet values, mail readers that implement this
> decoding should also ensure that display of the decoded data on the
> recipient's terminal will not cause unwanted side-effects

It seems that the "quoted-word" scheme is a valid way to include
a newline character in a header value, just like we already allow
undecodable bytes or control characters.
They do need to be properly quoted when serialized to text, though.

This should fail for custom fold() implementations that aren't careful
about newlines.

(cherry picked from commit 0976339)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Bas Bloemsaat <[email protected]>
Co-authored-by: Serhiy Storchaka <[email protected]>
@bedevere-app

bedevere-app Bot commented Aug 2, 2024

Copy link
Copy Markdown

GH-122611 is a backport of this pull request to the 3.8 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.8 label Aug 2, 2024
Yhg1s pushed a commit that referenced this pull request Aug 6, 2024
@miss-islington @encukou
@basbloemsaat @serhiy-storchaka
[3.13] gh-121650: Encode newlines in headers, and verify headers are …
4aaa425 
…sound (GH-122233) (#122484)

gh-121650: Encode newlines in headers, and verify headers are sound (GH-122233)

GH-GH- Encode header parts that contain newlines

Per RFC 2047:

> [...] these encoding schemes allow the
> encoding of arbitrary octet values, mail readers that implement this
> decoding should also ensure that display of the decoded data on the
> recipient's terminal will not cause unwanted side-effects

It seems that the "quoted-word" scheme is a valid way to include
a newline character in a header value, just like we already allow
undecodable bytes or control characters.
They do need to be properly quoted when serialized to text, though.

GH-GH- Verify that email headers are well-formed

This should fail for custom fold() implementations that aren't careful
about newlines.

(cherry picked from commit 0976339)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Bas Bloemsaat <[email protected]>
Co-authored-by: Serhiy Storchaka <[email protected]>
Yhg1s pushed a commit that referenced this pull request Aug 6, 2024
@encukou
[3.12] gh-121650: Encode newlines in headers, and verify headers are …
4766d12 
…sound (GH-122233) (#122599)

* gh-121650: Encode newlines in headers, and verify headers are sound (GH-122233)

- Encode header parts that contain newlines

Per RFC 2047:

> [...] these encoding schemes allow the
> encoding of arbitrary octet values, mail readers that implement this
> decoding should also ensure that display of the decoded data on the
> recipient's terminal will not cause unwanted side-effects

It seems that the "quoted-word" scheme is a valid way to include
a newline character in a header value, just like we already allow
undecodable bytes or control characters.
They do need to be properly quoted when serialized to text, though.

- Verify that email headers are well-formed

This should fail for custom fold() implementations that aren't careful
about newlines.

Co-authored-by: Bas Bloemsaat <[email protected]>
Co-authored-by: Serhiy Storchaka <[email protected]>
(cherry picked from commit 0976339)

* Document changes as made in 3.12.5
hroncok pushed a commit to fedora-python/cpython that referenced this pull request Aug 6, 2024
@miss-islington @encukou
@basbloemsaat @serhiy-storchaka @hroncok
00435: pythongh-121650: Encode newlines in headers, and verify header…
4217d97 
…s are sound

pythongh-121650: Encode newlines in headers, and verify headers are sound (pythonGH-122233)

Encode header parts that contain newlines

Per RFC 2047:

> [...] these encoding schemes allow the
> encoding of arbitrary octet values, mail readers that implement this
> decoding should also ensure that display of the decoded data on the
> recipient's terminal will not cause unwanted side-effects

It seems that the "quoted-word" scheme is a valid way to include
a newline character in a header value, just like we already allow
undecodable bytes or control characters.
They do need to be properly quoted when serialized to text, though.

Verify that email headers are well-formed

This should fail for custom fold() implementations that aren't careful
about newlines.

(cherry picked from commit 0976339)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Bas Bloemsaat <[email protected]>
Co-authored-by: Serhiy Storchaka <[email protected]>
frenzymadness pushed a commit to frenzymadness/cpython that referenced this pull request Aug 13, 2024
@encukou @basbloemsaat
@serhiy-storchaka @frenzymadness
00435: pythongh-121650: Encode newlines in headers, and verify header…
602c34f 
…s are sound (pythonGH-122233)

Per RFC 2047:

> [...] these encoding schemes allow the
> encoding of arbitrary octet values, mail readers that implement this
> decoding should also ensure that display of the decoded data on the
> recipient's terminal will not cause unwanted side-effects

It seems that the "quoted-word" scheme is a valid way to include
a newline character in a header value, just like we already allow
undecodable bytes or control characters.
They do need to be properly quoted when serialized to text, though.

This should fail for custom fold() implementations that aren't careful
about newlines.

(cherry picked from commit 0976339)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Bas Bloemsaat <[email protected]>
Co-authored-by: Serhiy Storchaka <[email protected]>
frenzymadness pushed a commit to fedora-python/cpython that referenced this pull request Aug 15, 2024
@encukou @basbloemsaat
@serhiy-storchaka @frenzymadness
00435: pythongh-121650: Encode newlines in headers, and verify header…
5b2ff0e 
…s are sound (pythonGH-122233)

Per RFC 2047:

> [...] these encoding schemes allow the
> encoding of arbitrary octet values, mail readers that implement this
> decoding should also ensure that display of the decoded data on the
> recipient's terminal will not cause unwanted side-effects

It seems that the "quoted-word" scheme is a valid way to include
a newline character in a header value, just like we already allow
undecodable bytes or control characters.
They do need to be properly quoted when serialized to text, though.

This should fail for custom fold() implementations that aren't careful
about newlines.

(cherry picked from commit 0976339)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Bas Bloemsaat <[email protected]>
Co-authored-by: Serhiy Storchaka <[email protected]>
stratakis pushed a commit to stratakis/cpython that referenced this pull request Aug 15, 2024
@encukou @basbloemsaat
@serhiy-storchaka @stratakis
00435: pythongh-121650: Encode newlines in headers, and verify header…
b23c8a0 
…s are sound (pythonGH-122233)

Per RFC 2047:

> [...] these encoding schemes allow the
> encoding of arbitrary octet values, mail readers that implement this
> decoding should also ensure that display of the decoded data on the
> recipient's terminal will not cause unwanted side-effects

It seems that the "quoted-word" scheme is a valid way to include
a newline character in a header value, just like we already allow
undecodable bytes or control characters.
They do need to be properly quoted when serialized to text, though.

This should fail for custom fold() implementations that aren't careful
about newlines.

(cherry picked from commit 0976339)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Bas Bloemsaat <[email protected]>
Co-authored-by: Serhiy Storchaka <[email protected]>
hrnciar added a commit to hrnciar/cpython that referenced this pull request Aug 16, 2024
@hrnciar @bsiem
00435: pythongh-121650: Encode newlines in headers, and verify
385d6b9 
 headers are sound (pythonGH-122233)

Per RFC 2047:

> [...] these encoding schemes allow the
> encoding of arbitrary octet values, mail readers that implement this
> decoding should also ensure that display of the decoded data on the
> recipient's terminal will not cause unwanted side-effects

It seems that the "quoted-word" scheme is a valid way to include
a newline character in a header value, just like we already allow
undecodable bytes or control characters.
They do need to be properly quoted when serialized to text, though.

This should fail for custom fold() implementations that aren't careful
about newlines.

(cherry picked from commit 0976339)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Bas Bloemsaat <[email protected]>
Co-authored-by: Serhiy Storchaka <[email protected]>

This patch also contains modified commit cherry picked from
c5bba85.

This commit was backported to simplify the backport of the other commit
fixing CVE. The only modification is a removal of one test case which
tests multiple changes in Python 3.7 and it wasn't working properly
with Python 3.6 where we backported only one change.

Co-authored-by: bsiem <[email protected]>
hrnciar added a commit to fedora-python/cpython that referenced this pull request Aug 16, 2024
@hrnciar @encukou
@basbloemsaat @serhiy-storchaka @bsiem
00435: pythongh-121650: Encode newlines in headers, and verify
1ee66de 
 headers are sound (pythonGH-122233)

Per RFC 2047:

> [...] these encoding schemes allow the
> encoding of arbitrary octet values, mail readers that implement this
> decoding should also ensure that display of the decoded data on the
> recipient's terminal will not cause unwanted side-effects

It seems that the "quoted-word" scheme is a valid way to include
a newline character in a header value, just like we already allow
undecodable bytes or control characters.
They do need to be properly quoted when serialized to text, though.

This should fail for custom fold() implementations that aren't careful
about newlines.

(cherry picked from commit 0976339)

This patch also contains modified commit cherry picked from
c5bba85.

This commit was backported to simplify the backport of the other commit
fixing CVE. The only modification is a removal of one test case which
tests multiple changes in Python 3.7 and it wasn't working properly
with Python 3.6 where we backported only one change.

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Bas Bloemsaat <[email protected]>
Co-authored-by: Serhiy Storchaka <[email protected]>
Co-authored-by: bsiem <[email protected]>
hrnciar added a commit to fedora-python/cpython that referenced this pull request Aug 20, 2024
@hrnciar @encukou
@basbloemsaat @serhiy-storchaka @bsiem
00435: pythongh-121650: Encode newlines in headers, and verify
f75f869 
 headers are sound (pythonGH-122233)

Per RFC 2047:

> [...] these encoding schemes allow the
> encoding of arbitrary octet values, mail readers that implement this
> decoding should also ensure that display of the decoded data on the
> recipient's terminal will not cause unwanted side-effects

It seems that the "quoted-word" scheme is a valid way to include
a newline character in a header value, just like we already allow
undecodable bytes or control characters.
They do need to be properly quoted when serialized to text, though.

This should fail for custom fold() implementations that aren't careful
about newlines.

(cherry picked from commit 0976339)

This patch also contains modified commit cherry picked from
c5bba85.

This commit was backported to simplify the backport of the other commit
fixing CVE. The only modification is a removal of one test case which
tests multiple changes in Python 3.7 and it wasn't working properly
with Python 3.6 where we backported only one change.

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Bas Bloemsaat <[email protected]>
Co-authored-by: Serhiy Storchaka <[email protected]>
Co-authored-by: bsiem <[email protected]>
blhsing pushed a commit to blhsing/cpython that referenced this pull request Aug 22, 2024
@encukou @basbloemsaat
@serhiy-storchaka @blhsing
pythongh-121650: Encode newlines in headers, and verify headers are s…
0647947 
…ound (pythonGH-122233)

## Encode header parts that contain newlines

Per RFC 2047:

> [...] these encoding schemes allow the
> encoding of arbitrary octet values, mail readers that implement this
> decoding should also ensure that display of the decoded data on the
> recipient's terminal will not cause unwanted side-effects

It seems that the "quoted-word" scheme is a valid way to include
a newline character in a header value, just like we already allow
undecodable bytes or control characters.
They do need to be properly quoted when serialized to text, though.


## Verify that email headers are well-formed

This should fail for custom fold() implementations that aren't careful
about newlines.


Co-authored-by: Bas Bloemsaat <[email protected]>
Co-authored-by: Serhiy Storchaka <[email protected]>
ambv added a commit that referenced this pull request Sep 4, 2024
@ambv @encukou
@basbloemsaat @serhiy-storchaka
[3.8] gh-121650: Encode newlines in headers, and verify headers are s…
b158a76 
…ound (GH-122233) (#122611)

Per RFC 2047:

> [...] these encoding schemes allow the
> encoding of arbitrary octet values, mail readers that implement this
> decoding should also ensure that display of the decoded data on the
> recipient's terminal will not cause unwanted side-effects

It seems that the "quoted-word" scheme is a valid way to include
a newline character in a header value, just like we already allow
undecodable bytes or control characters.
They do need to be properly quoted when serialized to text, though.

This should fail for custom fold() implementations that aren't careful
about newlines.

(cherry picked from commit 0976339)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Bas Bloemsaat <[email protected]>
Co-authored-by: Serhiy Storchaka <[email protected]>
ambv added a commit that referenced this pull request Sep 4, 2024
@ambv @encukou
@basbloemsaat @serhiy-storchaka
[3.11] gh-121650: Encode newlines in headers, and verify headers are …
f7c0f09 
…sound (GH-122233) (#122608)

Per RFC 2047:

> [...] these encoding schemes allow the
> encoding of arbitrary octet values, mail readers that implement this
> decoding should also ensure that display of the decoded data on the
> recipient's terminal will not cause unwanted side-effects

It seems that the "quoted-word" scheme is a valid way to include
a newline character in a header value, just like we already allow
undecodable bytes or control characters.
They do need to be properly quoted when serialized to text, though.

Verify that email headers are well-formed.

This should fail for custom fold() implementations that aren't careful
about newlines.

(cherry picked from commit 0976339)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Bas Bloemsaat <[email protected]>
Co-authored-by: Serhiy Storchaka <[email protected]>
ambv added a commit that referenced this pull request Sep 4, 2024
@ambv @encukou
@basbloemsaat @serhiy-storchaka
[3.10] gh-121650: Encode newlines in headers, and verify headers are …
06f28dc 
…sound (GH-122233) (#122609)

Per RFC 2047:

> [...] these encoding schemes allow the
> encoding of arbitrary octet values, mail readers that implement this
> decoding should also ensure that display of the decoded data on the
> recipient's terminal will not cause unwanted side-effects

It seems that the "quoted-word" scheme is a valid way to include
a newline character in a header value, just like we already allow
undecodable bytes or control characters.
They do need to be properly quoted when serialized to text, though.

This should fail for custom fold() implementations that aren't careful
about newlines.

(cherry picked from commit 0976339)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Bas Bloemsaat <[email protected]>
Co-authored-by: Serhiy Storchaka <[email protected]>
ambv added a commit that referenced this pull request Sep 4, 2024
@ambv @encukou
@basbloemsaat @serhiy-storchaka
[3.9] gh-121650: Encode newlines in headers, and verify headers are s…
f7be505 
…ound (GH-122233) (#122610)

Per RFC 2047:

> [...] these encoding schemes allow the
> encoding of arbitrary octet values, mail readers that implement this
> decoding should also ensure that display of the decoded data on the
> recipient's terminal will not cause unwanted side-effects

It seems that the "quoted-word" scheme is a valid way to include
a newline character in a header value, just like we already allow
undecodable bytes or control characters.
They do need to be properly quoted when serialized to text, though.

This should fail for custom fold() implementations that aren't careful
about newlines.

(cherry picked from commit 0976339)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Bas Bloemsaat <[email protected]>
Co-authored-by: Serhiy Storchaka <[email protected]>
brainhoard-github pushed a commit to distro-core-curated-mirrors/poky-contrib that referenced this pull request Sep 16, 2024
@anusurivijay @sakoman
python3: upgrade 3.12.4 -> 3.12.5
9406a1b 
Changelog: https://docs.python.org/release/3.12.5/whatsnew/changelog.html

Include security fix
CVE-2024-6923

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-6923
python/cpython#122233

(From OE-Core rev: 777cad793a5b07d392b1d9875530fb5480e75863)

Signed-off-by: Vijay Anusuri <[email protected]>
Signed-off-by: Steve Sakoman <[email protected]>
@julian-klode julian-klode mentioned this pull request Sep 17, 2024
Regression: ImportError for HeaderWriteError in long-running process post-Python update for CVE-2024-6923 #124170
Open
hrnciar added a commit to fedora-python/cpython that referenced this pull request Apr 23, 2025
@hrnciar @encukou
@basbloemsaat @serhiy-storchaka @bsiem
00435: pythongh-121650: Encode newlines in headers, and verify header…
94d6287 
…s are sound (pythonGH-122233)

Per RFC 2047:

> [...] these encoding schemes allow the
> encoding of arbitrary octet values, mail readers that implement this
> decoding should also ensure that display of the decoded data on the
> recipient's terminal will not cause unwanted side-effects

It seems that the "quoted-word" scheme is a valid way to include
a newline character in a header value, just like we already allow
undecodable bytes or control characters.
They do need to be properly quoted when serialized to text, though.

This should fail for custom fold() implementations that aren't careful
about newlines.

(cherry picked from commit 0976339)

This patch also contains modified commit cherry picked from
c5bba85.

This commit was backported to simplify the backport of the other commit
fixing CVE. The only modification is a removal of one test case which
tests multiple changes in Python 3.7 and it wasn't working properly
with Python 3.6 where we backported only one change.

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Bas Bloemsaat <[email protected]>
Co-authored-by: Serhiy Storchaka <[email protected]>
Co-authored-by: bsiem <[email protected]>
@medmunds medmunds mentioned this pull request May 6, 2025
EmailMessage objects break when folding malformed header #132105
Closed
@sajjaphani sajjaphani mentioned this pull request May 19, 2025
[Security] Vulnerability found in Security vulnerability BIT-python-2024-6923 in package python habitat-sh/foundational-packages#72
Closed
hroncok pushed a commit to fedora-python/cpython that referenced this pull request Jul 4, 2025
@hrnciar @encukou
@basbloemsaat @serhiy-storchaka @bsiem @hroncok
00435: pythongh-121650: Encode newlines in headers, and verify header…
40f8c12 
…s are sound (pythonGH-122233)

Per RFC 2047:

> [...] these encoding schemes allow the
> encoding of arbitrary octet values, mail readers that implement this
> decoding should also ensure that display of the decoded data on the
> recipient's terminal will not cause unwanted side-effects

It seems that the "quoted-word" scheme is a valid way to include
a newline character in a header value, just like we already allow
undecodable bytes or control characters.
They do need to be properly quoted when serialized to text, though.

This should fail for custom fold() implementations that aren't careful
about newlines.

(cherry picked from commit 0976339)

This patch also contains modified commit cherry picked from
c5bba85.

This commit was backported to simplify the backport of the other commit
fixing CVE. The only modification is a removal of one test case which
tests multiple changes in Python 3.7 and it wasn't working properly
with Python 3.6 where we backported only one change.

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Bas Bloemsaat <[email protected]>
Co-authored-by: Serhiy Storchaka <[email protected]>
Co-authored-by: bsiem <[email protected]>
frenzymadness pushed a commit to fedora-python/cpython that referenced this pull request Aug 12, 2025
@hrnciar @encukou
@basbloemsaat @serhiy-storchaka @bsiem @frenzymadness
00435: pythongh-121650: Encode newlines in headers, and verify header…
7b4affe 
…s are sound (pythonGH-122233)

Per RFC 2047:

> [...] these encoding schemes allow the
> encoding of arbitrary octet values, mail readers that implement this
> decoding should also ensure that display of the decoded data on the
> recipient's terminal will not cause unwanted side-effects

It seems that the "quoted-word" scheme is a valid way to include
a newline character in a header value, just like we already allow
undecodable bytes or control characters.
They do need to be properly quoted when serialized to text, though.

This should fail for custom fold() implementations that aren't careful
about newlines.

(cherry picked from commit 0976339)

This patch also contains modified commit cherry picked from
c5bba85.

This commit was backported to simplify the backport of the other commit
fixing CVE. The only modification is a removal of one test case which
tests multiple changes in Python 3.7 and it wasn't working properly
with Python 3.6 where we backported only one change.

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Bas Bloemsaat <[email protected]>
Co-authored-by: Serhiy Storchaka <[email protected]>
Co-authored-by: bsiem <[email protected]>
@ibm-mend-app ibm-mend-app Bot mentioned this pull request Sep 17, 2025
rustpython-pylib-0.4.0.crate: 28 vulnerabilities (highest severity is: 9.8) IBM/prompt-declaration-language#1198
Closed
sethmlarson pushed a commit to sethmlarson/cpython that referenced this pull request Jan 21, 2026
@beledouxdenis @encukou
@basbloemsaat @sethmlarson
email: verify headers are sound in BytesGenerator
0167315 
pythonGH-122233 added an implementation to `Generator`
to refuse to serialize (write) headers that
are unsafely folded or delimited.

This revision adds the same implementation
to `BytesGenerator`, so it gets the same safety protections
for unsafely folded or delimited headers

Co-authored-by: Denis Ledoux <[email protected]>
Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Bas Bloemsaat <[email protected]>
sethmlarson pushed a commit to sethmlarson/cpython that referenced this pull request Jan 21, 2026
@beledouxdenis @encukou
@basbloemsaat @sethmlarson
pythongh-144125: email: verify headers are sound in BytesGenerator
cd41a69 
pythonGH-122233 added an implementation to `Generator`
to refuse to serialize (write) headers that
are unsafely folded or delimited.

This revision adds the same implementation
to `BytesGenerator`, so it gets the same safety protections
for unsafely folded or delimited headers

Co-authored-by: Denis Ledoux <[email protected]>
Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Bas Bloemsaat <[email protected]>
@sethmlarson sethmlarson mentioned this pull request Jan 21, 2026
gh-144125: email: verify headers are sound in BytesGenerator #144126
Merged
sethmlarson pushed a commit to sethmlarson/cpython that referenced this pull request Jan 21, 2026
@beledouxdenis @encukou
@basbloemsaat @sethmlarson
pythongh-144125: email: verify headers are sound in BytesGenerator
1132e45 
pythonGH-122233 added an implementation to `Generator`
to refuse to serialize (write) headers that
are unsafely folded or delimited.

This revision adds the same implementation
to `BytesGenerator`, so it gets the same safety protections
for unsafely folded or delimited headers

Co-authored-by: Denis Ledoux <[email protected]>
Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Bas Bloemsaat <[email protected]>
hroncok pushed a commit to fedora-python/cpython that referenced this pull request Feb 3, 2026
@hrnciar @encukou
@basbloemsaat @serhiy-storchaka @bsiem @hroncok
00435: pythongh-121650: Encode newlines in headers, and verify header…
5ed53b9 
…s are sound (pythonGH-122233)

Per RFC 2047:

> [...] these encoding schemes allow the
> encoding of arbitrary octet values, mail readers that implement this
> decoding should also ensure that display of the decoded data on the
> recipient's terminal will not cause unwanted side-effects

It seems that the "quoted-word" scheme is a valid way to include
a newline character in a header value, just like we already allow
undecodable bytes or control characters.
They do need to be properly quoted when serialized to text, though.

This should fail for custom fold() implementations that aren't careful
about newlines.

(cherry picked from commit 0976339)

This patch also contains modified commit cherry picked from
c5bba85.

This commit was backported to simplify the backport of the other commit
fixing CVE. The only modification is a removal of one test case which
tests multiple changes in Python 3.7 and it wasn't working properly
with Python 3.6 where we backported only one change.

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Bas Bloemsaat <[email protected]>
Co-authored-by: Serhiy Storchaka <[email protected]>
Co-authored-by: bsiem <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@serhiy-storchaka serhiy-storchaka serhiy-storchaka approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@encukou encukou

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

5 participants

@encukou @basbloemsaat @bedevere-bot @ambv @serhiy-storchaka
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.