GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [3.11] gh-121284: Fix email address header folding with parsed encoded-word (GH-122754) by miss-islington · Pull Request #131405 · python/cpython

Conversation

@miss-islington

@miss-islington miss-islington commented Mar 18, 2025 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Email generators using email.policy.default may convert an RFC 2047
encoded-word to unencoded form during header refolding. In a structured
header, this could allow 'specials' chars outside a quoted-string,
leading to invalid address headers and enabling spoofing. This change
ensures a parsed encoded-word that contains specials is kept as an
encoded-word while the header is refolded.

[Better fix from @bitdancer.]

(cherry picked from commit 295b53d)

Co-authored-by: Mike Edmunds [email protected]
Co-authored-by: R David Murray [email protected]
Co-authored-by: Petr Viktorin [email protected]

  • Issue: email: invalid RFC 2047 address header after refolding with email.policy.default  #121284

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@medmunds @bitdancer
@encukou @miss-islington
pythongh-121284: Fix email address header folding with parsed encoded…
9b5115f 
…-word (pythonGH-122754)

Email generators using email.policy.default may convert an RFC 2047
encoded-word to unencoded form during header refolding. In a structured
header, this could allow 'specials' chars outside a quoted-string,
leading to invalid address headers and enabling spoofing. This change
ensures a parsed encoded-word that contains specials is kept as an
encoded-word while the header is refolded.

[Better fix from @bitdancer.]

---------
(cherry picked from commit 295b53d)

Co-authored-by: Mike Edmunds <[email protected]>
Co-authored-by: R David Murray <[email protected]>
Co-authored-by: Petr Viktorin <[email protected]>
@miss-islington
miss-islington requested a review from a team as a code owner March 18, 2025 11:07
@bedevere-app bedevere-app Bot added topic-email type-security A security issue labels Mar 18, 2025
@bedevere-app bedevere-app Bot mentioned this pull request Mar 18, 2025
gh-121284: Fix email address header folding with parsed encoded-word #122754
Merged
@bedevere-app bedevere-app Bot added the awaiting review label Mar 18, 2025
@bedevere-app bedevere-app Bot mentioned this pull request Mar 18, 2025
email: invalid RFC 2047 address header after refolding with email.policy.default #121284
Closed
bitdancer
bitdancer approved these changes Mar 18, 2025
View reviewed changes
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting review labels Mar 18, 2025
@ambv
ambv merged commit 0a66052 into python:3.11 Apr 3, 2025
@bedevere-app bedevere-app Bot removed the awaiting merge label Apr 3, 2025
@miss-islington
miss-islington deleted the backport-295b53d-3.11 branch January 2, 2026 17:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bitdancer bitdancer bitdancer approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

topic-email type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@miss-islington @bitdancer @ambv @medmunds
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.