diff options
| author | jpic <jpic@users.noreply.github.com> | 2019-07-17 21:54:25 (GMT) |
|---|---|---|
| committer | Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> | 2019-07-17 21:54:25 (GMT) |
| commit | 8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9 (patch) | |
| tree | 66906fde428f0af62b753d529cd28a87c9e7438c /Lib/email/_header_value_parser.py | |
| parent | 719a062bcb7b08a56e6576dcd75f4244e6053209 (diff) | |
| download | cpython-8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9.zip cpython-8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9.tar.gz cpython-8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9.tar.bz2 | |
bpo-34155: Dont parse domains containing @ (GH-13079)
Before:
>>> email.message_from_string('From: a@malicious.org@important.com', policy=email.policy.default)['from'].addresses
(Address(display_name='', username='a', domain='malicious.org'),)
>>> parseaddr('a@malicious.org@important.com')
('', 'a@malicious.org')
After:
>>> email.message_from_string('From: a@malicious.org@important.com', policy=email.policy.default)['from'].addresses
(Address(display_name='', username='', domain=''),)
>>> parseaddr('a@malicious.org@important.com')
('', 'a@')
https://bugs.python.org/issue34155
Diffstat (limited to 'Lib/email/_header_value_parser.py')
| -rw-r--r-- | Lib/email/_header_value_parser.py | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/Lib/email/_header_value_parser.py b/Lib/email/_header_value_parser.py index daff57b..641e097 100644 --- a/Lib/email/_header_value_parser.py +++ b/Lib/email/_header_value_parser.py @@ -1587,6 +1587,8 @@ def get_domain(value): token, value = get_dot_atom(value) except errors.HeaderParseError: token, value = get_atom(value) + if value and value[0] == '@': + raise errors.HeaderParseError('Invalid Domain') if leader is not None: token[:0] = [leader] domain.append(token) |