GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [2.7] bpo-34155: Dont parse domains containing @ (GH-13079) by rcsanchez97 · Pull Request #16006 · python/cpython

Conversation

@rcsanchez97

@rcsanchez97 rcsanchez97 commented Sep 11, 2019 •
edited by miss-islington
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

This change skips parsing of email addresses where domains include a "@" character, which can be maliciously used since the local part is returned as a complete address.

(cherry picked from commit 8cb65d1)

Excludes changes to Lib/email/_header_value_parser.py, which did not
exist in 2.7.

Co-authored-by: jpic [email protected]

https://bugs.python.org/issue34155

Automerge-Triggered-By: @maxking

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@rcsanchez97 @jpic
[2.7] bpo-34155: Dont parse domains containing @ (GH-13079)
c282890 
https://bugs.python.org/issue34155
(cherry picked from commit 8cb65d1)

Excludes changes to Lib/email/_header_value_parser.py, which did not
exist in 2.7.

Co-authored-by: jpic <[email protected]>
@bedevere-bot bedevere-bot mentioned this pull request Sep 11, 2019
bpo-34155: Dont parse domains containing @ #13079
Merged
@the-knights-who-say-ni

the-knights-who-say-ni commented Sep 11, 2019

Copy link
Copy Markdown

Hello, and thanks for your contribution!

I'm a bot set up to make sure that the project can legally accept this contribution by verifying everyone involved has signed the PSF contributor agreement (CLA).

Recognized GitHub username

We couldn't find a bugs.python.org (b.p.o) account corresponding to the following GitHub usernames:

@rcsanchez97

This might be simply due to a missing "GitHub Name" entry in one's b.p.o account settings. This is necessary for legal reasons before we can look at this contribution. Please follow the steps outlined in the CPython devguide to rectify this issue.

You can check yourself to see if the CLA has been received.

Thanks again for the contribution, we look forward to reviewing it!
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@the-knights-who-say-ni the-knights-who-say-ni added the CLA not signed label Sep 11, 2019
@bedevere-bot bedevere-bot added type-security A security issue awaiting review labels Sep 11, 2019
@vstinner

vstinner commented Sep 13, 2019

Copy link
Copy Markdown
Member

@rcsanchez97: Can you please sign the CLA? See the previous comment for the procedure.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@the-knights-who-say-ni the-knights-who-say-ni added CLA signed and removed CLA not signed labels Sep 13, 2019
@rcsanchez97

rcsanchez97 commented Sep 13, 2019

Copy link
Copy Markdown
Author

@vstinner That is very strange. I signed the CLA at the same time I created the PR. However, the CLA not signed label was only removed moments ago when I used the link to check that it had been recorded as being signed.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
vstinner
vstinner approved these changes Sep 13, 2019
View reviewed changes

@vstinner vstinner left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. But I would prefer to have a double check from another core dev.

@maxking or @warsaw: Can you please review this PR?

I compared with 8cb65d1 : the code looks the same. The 2.7 backport lacks the get_domain() change which raises HeaderParseError: Python 2.7 doens't have the parser.get_addr_spec() function, so I understand that it doesn't need this change.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@bedevere-bot bedevere-bot added awaiting merge and removed awaiting review labels Sep 13, 2019
maxking
maxking approved these changes Sep 14, 2019
View reviewed changes

@maxking maxking left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

Thank @rcsanchez97 for the backport and @vstinner for helping review.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@maxking maxking added the 🤖 automerge label Sep 14, 2019
@miss-islington
miss-islington merged commit 4cbcd2f into python:2.7 Sep 14, 2019
@bedevere-bot bedevere-bot removed the awaiting merge label Sep 14, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vstinner vstinner vstinner approved these changes
+1 more reviewer
@maxking maxking maxking approved these changes
Reviewers whose approvals may not affect merge requirements

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

6 participants

@rcsanchez97 @the-knights-who-say-ni @vstinner @maxking @bedevere-bot @miss-islington
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.