diff options
| -rw-r--r-- | Lib/email/header.py | 10 | ||||
| -rw-r--r-- | Lib/email/test/test_email.py | 11 | ||||
| -rw-r--r-- | Misc/NEWS | 7 |
3 files changed, 27 insertions, 1 deletions
diff --git a/Lib/email/header.py b/Lib/email/header.py index 9e91dc2..702adf1 100644 --- a/Lib/email/header.py +++ b/Lib/email/header.py @@ -47,6 +47,10 @@ ecre = re.compile(r''' # For use with .match() fcre = re.compile(r'[\041-\176]+:$') +# Find a header embeded in a putative header value. Used to check for +# header injection attack. +_embeded_header = re.compile(r'\n[^ \t]+:') + # Helpers @@ -403,7 +407,11 @@ class Header: newchunks += self._split(s, charset, targetlen, splitchars) lastchunk, lastcharset = newchunks[-1] lastlen = lastcharset.encoded_header_len(lastchunk) - return self._encode_chunks(newchunks, maxlinelen) + value = self._encode_chunks(newchunks, maxlinelen) + if _embeded_header.search(value): + raise HeaderParseError("header value appears to contain " + "an embedded header: {!r}".format(value)) + return value diff --git a/Lib/email/test/test_email.py b/Lib/email/test/test_email.py index 4aac500..5c9a725 100644 --- a/Lib/email/test/test_email.py +++ b/Lib/email/test/test_email.py @@ -553,6 +553,17 @@ class TestMessageAPI(TestEmailBase): msg.set_charset(u'us-ascii') self.assertEqual('us-ascii', msg.get_content_charset()) + # Issue 5871: reject an attempt to embed a header inside a header value + # (header injection attack). + def test_embeded_header_via_Header_rejected(self): + msg = Message() + msg['Dummy'] = Header('dummy\nX-Injected-Header: test') + self.assertRaises(Errors.HeaderParseError, msg.as_string) + + def test_embeded_header_via_string_rejected(self): + msg = Message() + msg['Dummy'] = 'dummy\nX-Injected-Header: test' + self.assertRaises(Errors.HeaderParseError, msg.as_string) # Test the email.Encoders module @@ -36,6 +36,13 @@ Library dependent, but ``time.mktime`` will now accept full range supported by the OS. Conversion of 2-digit years to 4-digit is deprecated. +- Issue #10827: Changed the rules for 2-digit years. The time.asctime + function will now format any year when ``time.accept2dyear`` is + false and will accept years >= 1000 otherwise. The year range + accepted by ``time.mktime`` and ``time.strftime`` is still system + dependent, but ``time.mktime`` will now accept full range supported + by the OS. Conversion of 2-digit years to 4-digit is deprecated. + - Issue #7858: Raise an error properly when os.utime() fails under Windows on an existing file. |