diff options
| author | Abhilash Raj <maxking@users.noreply.github.com> | 2019-07-17 16:44:27 (GMT) |
|---|---|---|
| committer | Barry Warsaw <barry@python.org> | 2019-07-17 16:44:27 (GMT) |
| commit | a4a994bd3e619cbaff97610a1cee8ffa87c672f5 (patch) | |
| tree | 6aee3d24c4a984481adf2921c31108635b0857ce /Lib | |
| parent | 82494aa6d947c4a320c09c58fe0f100cdcf7af0b (diff) | |
| download | cpython-a4a994bd3e619cbaff97610a1cee8ffa87c672f5.zip cpython-a4a994bd3e619cbaff97610a1cee8ffa87c672f5.tar.gz cpython-a4a994bd3e619cbaff97610a1cee8ffa87c672f5.tar.bz2 | |
bpo-37461: Fix infinite loop in parsing of specially crafted email headers (GH-14794)
* bpo-37461: Fix infinite loop in parsing of specially crafted email headers.
Some crafted email header would cause the get_parameter method to run in an
infinite loop causing a DoS attack surface when parsing those headers. This
patch fixes that by making sure the DQUOTE character is handled to prevent
going into an infinite loop.
Diffstat (limited to 'Lib')
| -rw-r--r-- | Lib/email/_header_value_parser.py | 3 | ||||
| -rw-r--r-- | Lib/test/test_email/test__header_value_parser.py | 7 |
2 files changed, 10 insertions, 0 deletions
diff --git a/Lib/email/_header_value_parser.py b/Lib/email/_header_value_parser.py index 37dc764..66b042e 100644 --- a/Lib/email/_header_value_parser.py +++ b/Lib/email/_header_value_parser.py @@ -2496,6 +2496,9 @@ def get_parameter(value): while value: if value[0] in WSP: token, value = get_fws(value) + elif value[0] == '"': + token = ValueTerminal('"', 'DQUOTE') + value = value[1:] else: token, value = get_qcontent(value) v.append(token) diff --git a/Lib/test/test_email/test__header_value_parser.py b/Lib/test/test_email/test__header_value_parser.py index c4e1a9f..a83915d 100644 --- a/Lib/test/test_email/test__header_value_parser.py +++ b/Lib/test/test_email/test__header_value_parser.py @@ -2710,6 +2710,13 @@ class Test_parse_mime_parameters(TestParserMixin, TestEmailBase): # Defects are apparent missing *0*, and two 'out of sequence'. [errors.InvalidHeaderDefect]*3), + # bpo-37461: Check that we don't go into an infinite loop. + 'extra_dquote': ( + 'r*="\'a\'\\"', + ' r="\\""', + 'r*=\'a\'"', + [('r', '"')], + [errors.InvalidHeaderDefect]*2), } @parameterize |