diff options
| author | Ashwin Ramaswami <aramaswamis@gmail.com> | 2020-03-30 00:38:41 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-03-30 00:38:41 (GMT) |
| commit | 614f17211c5fc0e5b828be1d3320661d1038fe8f (patch) | |
| tree | ceb4506a92bc77dab1954a7caed397587d6b2c14 /Lib/email | |
| parent | 0003c2dc1d4cf5b122e73e83177fd274fa9a9913 (diff) | |
| download | cpython-614f17211c5fc0e5b828be1d3320661d1038fe8f.zip cpython-614f17211c5fc0e5b828be1d3320661d1038fe8f.tar.gz cpython-614f17211c5fc0e5b828be1d3320661d1038fe8f.tar.bz2 | |
bpo-39073: validate Address parts to disallow CRLF (#19007)
Disallow CR or LF in email.headerregistry.Address arguments to guard against header injection attacks.
Diffstat (limited to 'Lib/email')
| -rw-r--r-- | Lib/email/headerregistry.py | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/Lib/email/headerregistry.py b/Lib/email/headerregistry.py index cc1d191..5d84fc0 100644 --- a/Lib/email/headerregistry.py +++ b/Lib/email/headerregistry.py @@ -31,6 +31,11 @@ class Address: without any Content Transfer Encoding. """ + + inputs = ''.join(filter(None, (display_name, username, domain, addr_spec))) + if '\r' in inputs or '\n' in inputs: + raise ValueError("invalid arguments; address parts cannot contain CR or LF") + # This clause with its potential 'raise' may only happen when an # application program creates an Address object using an addr_spec # keyword. The email library code itself must always supply username |