[3.3] bpo-30119: fix ftplib.FTP.putline() to throw an error for a illegal command...

diff --git a/Lib/ftplib.py b/Lib/ftplib.py
index 5e75e6d4227affec98b7e8f205ef352e0c19d727..ca7225f1d9408b798d23ef062c3e897b15059316 100644 (file)
--- a/Lib/ftplib.py
+++ b/Lib/ftplib.py
@@ -185,6 +185,8 @@ class FTP:
 
     # Internal: send one line to the server, appending CRLF
     def putline(self, line):
+        if '\r' in line or '\n' in line:
+            raise ValueError('an illegal newline character should not be contained')
         line = line + CRLF
         if self.debugging > 1: print('*put*', self.sanitize(line))
         self.sock.sendall(line.encode(self.encoding))

diff --git a/Lib/test/test_ftplib.py b/Lib/test/test_ftplib.py
index 6c95c491ffdf4e2aa19a33b9f72c56c925955451..c5e6736f8ba1197e9940cf1262edf01dcd95c349 100644 (file)
--- a/Lib/test/test_ftplib.py
+++ b/Lib/test/test_ftplib.py
@@ -480,6 +480,9 @@ class TestFTPClass(TestCase):
         self.assertEqual(self.client.sanitize('PASS 12345'), repr('PASS *****'))
 
     def test_exceptions(self):
+        self.assertRaises(ValueError, self.client.sendcmd, 'echo 40\r\n0')
+        self.assertRaises(ValueError, self.client.sendcmd, 'echo 40\n0')
+        self.assertRaises(ValueError, self.client.sendcmd, 'echo 40\r0')
         self.assertRaises(ftplib.error_temp, self.client.sendcmd, 'echo 400')
         self.assertRaises(ftplib.error_temp, self.client.sendcmd, 'echo 499')
         self.assertRaises(ftplib.error_perm, self.client.sendcmd, 'echo 500')
@@ -488,7 +491,8 @@ class TestFTPClass(TestCase):
 
     def test_all_errors(self):
         exceptions = (ftplib.error_reply, ftplib.error_temp, ftplib.error_perm,
-                      ftplib.error_proto, ftplib.Error, IOError, EOFError)
+                      ftplib.error_proto, ftplib.Error, OSError,
+                      EOFError)
         for x in exceptions:
             try:
                 raise x('exception not included in all_errors set')

diff --git a/Misc/NEWS b/Misc/NEWS
index 68a332302b18d17f7f0a4b57284ce258bfb09a31..2b4d4e798980d0da0c9bc09224150e7440b8f887 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -39,6 +39,9 @@ Core and Builtins
 Library
 -------
 
+- bpo-30119: ftplib.FTP.putline() now throws ValueError on commands that contains
+  CR or LF. Patch by Dong-hee Na
+
 - [Security] bpo-30730: Prevent environment variables injection in subprocess on
   Windows.  Prevent passing other invalid environment variables and command arguments.