-
-
Notifications
You must be signed in to change notification settings - Fork 29.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
gh-121650 : detect newlines in headers #121812
gh-121650 : detect newlines in headers #121812
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I wasn't able to confirm that this PR fixes #121650. The original reproducer still contains the embedded newline:
from email import message_from_string
from email.policy import default
email_in = """\
To: incoming+tag@me.example.com
From: External Sender <sender@them.example.com>
Subject: Here's an =?UTF-8?Q?embedded_newline=0A?=
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
<html>
<head><title>An embeded newline</title></head>
<body>
<p>I sent you an embedded newline in the subject. How do you like that?!</p>
</body>
</html>
"""
msg = message_from_string(email_in, policy=default)
msg = message_from_string(email_in, policy=default)
for header, value in msg.items():
del msg[header]
msg[header] = value
email_out = str(msg)
print(email_out)
Misc/NEWS.d/next/Library/2024-07-15-21-43-38.gh-issue-121650.A0FkCh.rst
Outdated
Show resolved
Hide resolved
Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
…0FkCh.rst Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
I missed headers that were parsed from a message, as in original issue. I updated the fix and the tests. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Confirmed that this fixes #121650. I'm pretty sure this is a security fix (as you could previously inject email headers using this method), so this should need a backport all the way to 3.8
@warsaw, @bitdancer, @maxking: as the email experts, do you have any comments? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The fix looks good to me! Thank you for digging into it!
I take back the review. There's more to this, unfortunately :( Here's another reproducer: from email import message_from_string
from email.policy import default
email_in = """\
To: incoming+tag@me.example.com
From: External Sender <sender@them.example.com> =?UTF-8?Q?embedded_newline=0A?=Smuggled-Data: Bad
Subject: foo <bar> Here's an
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
<html>
<head><title>An embeded newline</title></head>
<body>
<p>I sent you an embedded newline in the subject. How do you like that?!</p>
</body>
</html>
"""
msg = message_from_string(email_in, policy=default)
print(msg)
for header, value in msg.items():
del msg[header]
msg[header] = value
email_out = str(msg)
print(email_out) |
I'll look into this... |
…com:basbloemsaat/cpython into fix-issue-121650-detect-newlines-in-headers
@encukou I tried all header types. This eliminates all newlines. Two notes:
|
After reading up on the email module, I propose to fix the issue in a different part of the code: see #122233. |
Closing in favour of #122233. |
@encukou as promised, the fix for this issue.
This PR fixes both issues addressed in the issue, both the newlines at the end as well as the encoded newlines.
As this has security implication, it may need to be backported as well.