]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
bpo-34155: Dont parse domains containing @ (GH-13079) (GH-14826)
authorMiss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Fri, 9 Aug 2019 15:22:19 +0000 (08:22 -0700)
committerNed Deily <nad@python.org>
Fri, 9 Aug 2019 15:22:19 +0000 (11:22 -0400)
commit13a19139b5e76175bc95294d54afc9425e4f36c9
treed01b8ff0e7e5fbaa888b287d71ae444b3bd4119f
parent1789bbdd3e03023951a39933ef12dee0a03be616
bpo-34155: Dont parse domains containing @ (GH-13079) (GH-14826)

Before:

        >>> email.message_from_string('From: a@malicious.org@important.com', policy=email.policy.default)['from'].addresses
        (Address(display_name='', username='a', domain='malicious.org'),)

        >>> parseaddr('a@malicious.org@important.com')
        ('', 'a@malicious.org')

    After:

        >>> email.message_from_string('From: a@malicious.org@important.com', policy=email.policy.default)['from'].addresses
        (Address(display_name='', username='', domain=''),)

        >>> parseaddr('a@malicious.org@important.com')
        ('', 'a@')

https://bugs.python.org/issue34155
(cherry picked from commit 8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9)

Co-authored-by: jpic <jpic@users.noreply.github.com>
Lib/email/_header_value_parser.py
Lib/email/_parseaddr.py
Lib/test/test_email/test__header_value_parser.py
Lib/test/test_email/test_email.py
Misc/NEWS.d/next/Security/2019-05-04-13-33-37.bpo-34155.MJll68.rst [new file with mode: 0644]