]> granicus.if.org Git - python/commit
bpo-34155: Dont parse domains containing @ (GH-13079)
authorjpic <jpic@users.noreply.github.com>
Wed, 17 Jul 2019 21:54:25 +0000 (23:54 +0200)
committerMiss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Wed, 17 Jul 2019 21:54:25 +0000 (14:54 -0700)
commit8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9
tree66906fde428f0af62b753d529cd28a87c9e7438c
parent719a062bcb7b08a56e6576dcd75f4244e6053209
bpo-34155: Dont parse domains containing @ (GH-13079)

Before:

        >>> email.message_from_string('From: a@malicious.org@important.com', policy=email.policy.default)['from'].addresses
        (Address(display_name='', username='a', domain='malicious.org'),)

        >>> parseaddr('a@malicious.org@important.com')
        ('', 'a@malicious.org')

    After:

        >>> email.message_from_string('From: a@malicious.org@important.com', policy=email.policy.default)['from'].addresses
        (Address(display_name='', username='', domain=''),)

        >>> parseaddr('a@malicious.org@important.com')
        ('', 'a@')

https://bugs.python.org/issue34155
Lib/email/_header_value_parser.py
Lib/email/_parseaddr.py
Lib/test/test_email/test__header_value_parser.py
Lib/test/test_email/test_email.py
Misc/NEWS.d/next/Security/2019-05-04-13-33-37.bpo-34155.MJll68.rst [new file with mode: 0644]