diff options
| author | Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> | 2023-07-10 23:38:42 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-07-10 23:38:42 (GMT) |
| commit | 30870c834ce0e47cc689b56aed7ac468f6e1c1ad (patch) | |
| tree | 1634c849963f7a0720fea66ab0ca840a19d0b966 /Lib/test | |
| parent | 90ea3be6fbee1520dd3e9344c71123e15fcbe6f2 (diff) | |
| download | cpython-30870c834ce0e47cc689b56aed7ac468f6e1c1ad.zip cpython-30870c834ce0e47cc689b56aed7ac468f6e1c1ad.tar.gz cpython-30870c834ce0e47cc689b56aed7ac468f6e1c1ad.tar.bz2 | |
[3.12] gh-102988: Detect email address parsing errors and return empty tuple to indicate the parsing error (old API) (GH-105127) (#106612)
gh-102988: Detect email address parsing errors and return empty tuple to indicate the parsing error (old API) (GH-105127)
Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). This fixes or at least ameliorates CVE-2023-27043.
---------
(cherry picked from commit 18dfbd035775c15533d13a98e56b1d2bf5c65f00)
Co-authored-by: Thomas Dwyer <github@tomd.tel>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Diffstat (limited to 'Lib/test')
| -rw-r--r-- | Lib/test/test_email/test_email.py | 81 |
1 files changed, 78 insertions, 3 deletions
diff --git a/Lib/test/test_email/test_email.py b/Lib/test/test_email/test_email.py index 44b4057..5238944 100644 --- a/Lib/test/test_email/test_email.py +++ b/Lib/test/test_email/test_email.py @@ -3319,15 +3319,90 @@ Foo [('Al Person', 'aperson@dom.ain'), ('Bud Person', 'bperson@dom.ain')]) + def test_getaddresses_parsing_errors(self): + """Test for parsing errors from CVE-2023-27043""" + eq = self.assertEqual + eq(utils.getaddresses(['alice@example.org(<bob@example.com>']), + [('', '')]) + eq(utils.getaddresses(['alice@example.org)<bob@example.com>']), + [('', '')]) + eq(utils.getaddresses(['alice@example.org<<bob@example.com>']), + [('', '')]) + eq(utils.getaddresses(['alice@example.org><bob@example.com>']), + [('', '')]) + eq(utils.getaddresses(['alice@example.org@<bob@example.com>']), + [('', '')]) + eq(utils.getaddresses(['alice@example.org,<bob@example.com>']), + [('', 'alice@example.org'), ('', 'bob@example.com')]) + eq(utils.getaddresses(['alice@example.org;<bob@example.com>']), + [('', '')]) + eq(utils.getaddresses(['alice@example.org:<bob@example.com>']), + [('', '')]) + eq(utils.getaddresses(['alice@example.org.<bob@example.com>']), + [('', '')]) + eq(utils.getaddresses(['alice@example.org"<bob@example.com>']), + [('', '')]) + eq(utils.getaddresses(['alice@example.org[<bob@example.com>']), + [('', '')]) + eq(utils.getaddresses(['alice@example.org]<bob@example.com>']), + [('', '')]) + + def test_parseaddr_parsing_errors(self): + """Test for parsing errors from CVE-2023-27043""" + eq = self.assertEqual + eq(utils.parseaddr(['alice@example.org(<bob@example.com>']), + ('', '')) + eq(utils.parseaddr(['alice@example.org)<bob@example.com>']), + ('', '')) + eq(utils.parseaddr(['alice@example.org<<bob@example.com>']), + ('', '')) + eq(utils.parseaddr(['alice@example.org><bob@example.com>']), + ('', '')) + eq(utils.parseaddr(['alice@example.org@<bob@example.com>']), + ('', '')) + eq(utils.parseaddr(['alice@example.org,<bob@example.com>']), + ('', '')) + eq(utils.parseaddr(['alice@example.org;<bob@example.com>']), + ('', '')) + eq(utils.parseaddr(['alice@example.org:<bob@example.com>']), + ('', '')) + eq(utils.parseaddr(['alice@example.org.<bob@example.com>']), + ('', '')) + eq(utils.parseaddr(['alice@example.org"<bob@example.com>']), + ('', '')) + eq(utils.parseaddr(['alice@example.org[<bob@example.com>']), + ('', '')) + eq(utils.parseaddr(['alice@example.org]<bob@example.com>']), + ('', '')) + def test_getaddresses_nasty(self): eq = self.assertEqual eq(utils.getaddresses(['foo: ;']), [('', '')]) - eq(utils.getaddresses( - ['[]*-- =~$']), - [('', ''), ('', ''), ('', '*--')]) + eq(utils.getaddresses(['[]*-- =~$']), [('', '')]) eq(utils.getaddresses( ['foo: ;', '"Jason R. Mastaler" <jason@dom.ain>']), [('', ''), ('Jason R. Mastaler', 'jason@dom.ain')]) + eq(utils.getaddresses( + [r'Pete(A nice \) chap) <pete(his account)@silly.test(his host)>']), + [('Pete (A nice ) chap his account his host)', 'pete@silly.test')]) + eq(utils.getaddresses( + ['(Empty list)(start)Undisclosed recipients :(nobody(I know))']), + [('', '')]) + eq(utils.getaddresses( + ['Mary <@machine.tld:mary@example.net>, , jdoe@test . example']), + [('Mary', 'mary@example.net'), ('', ''), ('', 'jdoe@test.example')]) + eq(utils.getaddresses( + ['John Doe <jdoe@machine(comment). example>']), + [('John Doe (comment)', 'jdoe@machine.example')]) + eq(utils.getaddresses( + ['"Mary Smith: Personal Account" <smith@home.example>']), + [('Mary Smith: Personal Account', 'smith@home.example')]) + eq(utils.getaddresses( + ['Undisclosed recipients:;']), + [('', '')]) + eq(utils.getaddresses( + [r'<boss@nil.test>, "Giant; \"Big\" Box" <bob@example.net>']), + [('', 'boss@nil.test'), ('Giant; "Big" Box', 'bob@example.net')]) def test_getaddresses_embedded_comment(self): """Test proper handling of a nested comment""" |