diff options
| author | jpic <jpic@users.noreply.github.com> | 2019-07-17 21:54:25 (GMT) |
|---|---|---|
| committer | Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> | 2019-07-17 21:54:25 (GMT) |
| commit | 8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9 (patch) | |
| tree | 66906fde428f0af62b753d529cd28a87c9e7438c /Lib/test/test_email | |
| parent | 719a062bcb7b08a56e6576dcd75f4244e6053209 (diff) | |
| download | cpython-8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9.zip cpython-8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9.tar.gz cpython-8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9.tar.bz2 | |
bpo-34155: Dont parse domains containing @ (GH-13079)
Before:
>>> email.message_from_string('From: a@malicious.org@important.com', policy=email.policy.default)['from'].addresses
(Address(display_name='', username='a', domain='malicious.org'),)
>>> parseaddr('a@malicious.org@important.com')
('', 'a@malicious.org')
After:
>>> email.message_from_string('From: a@malicious.org@important.com', policy=email.policy.default)['from'].addresses
(Address(display_name='', username='', domain=''),)
>>> parseaddr('a@malicious.org@important.com')
('', 'a@')
https://bugs.python.org/issue34155
Diffstat (limited to 'Lib/test/test_email')
| -rw-r--r-- | Lib/test/test_email/test__header_value_parser.py | 10 | ||||
| -rw-r--r-- | Lib/test/test_email/test_email.py | 14 |
2 files changed, 24 insertions, 0 deletions
diff --git a/Lib/test/test_email/test__header_value_parser.py b/Lib/test/test_email/test__header_value_parser.py index 4fa56b1..877cd3e 100644 --- a/Lib/test/test_email/test__header_value_parser.py +++ b/Lib/test/test_email/test__header_value_parser.py @@ -1448,6 +1448,16 @@ class TestParser(TestParserMixin, TestEmailBase): self.assertEqual(addr_spec.domain, 'example.com') self.assertEqual(addr_spec.addr_spec, 'star.a.star@example.com') + def test_get_addr_spec_multiple_domains(self): + with self.assertRaises(errors.HeaderParseError): + parser.get_addr_spec('star@a.star@example.com') + + with self.assertRaises(errors.HeaderParseError): + parser.get_addr_spec('star@a@example.com') + + with self.assertRaises(errors.HeaderParseError): + parser.get_addr_spec('star@172.17.0.1@example.com') + # get_obs_route def test_get_obs_route_simple(self): diff --git a/Lib/test/test_email/test_email.py b/Lib/test/test_email/test_email.py index c29cc56..aa77588 100644 --- a/Lib/test/test_email/test_email.py +++ b/Lib/test/test_email/test_email.py @@ -3041,6 +3041,20 @@ class TestMiscellaneous(TestEmailBase): self.assertEqual(utils.parseaddr('<>'), ('', '')) self.assertEqual(utils.formataddr(utils.parseaddr('<>')), '') + def test_parseaddr_multiple_domains(self): + self.assertEqual( + utils.parseaddr('a@b@c'), + ('', '') + ) + self.assertEqual( + utils.parseaddr('a@b.c@c'), + ('', '') + ) + self.assertEqual( + utils.parseaddr('a@172.17.0.1@c'), + ('', '') + ) + def test_noquote_dump(self): self.assertEqual( utils.formataddr(('A Silly Person', 'person@dom.ain')), |