gh-121650 : detect newlines in headers #121812
Conversation
There was a problem hiding this comment.
I wasn't able to confirm that this PR fixes #121650. The original reproducer still contains the embedded newline:
from email import message_from_string
from email.policy import default
email_in = """\
To: [email protected]
From: External Sender <[email protected]>
Subject: Here's an =?UTF-8?Q?embedded_newline=0A?=
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
<html>
<head><title>An embeded newline</title></head>
<body>
<p>I sent you an embedded newline in the subject. How do you like that?!</p>
</body>
</html>
"""
msg = message_from_string(email_in, policy=default)
msg = message_from_string(email_in, policy=default)
for header, value in msg.items():
del msg[header]
msg[header] = value
email_out = str(msg)
print(email_out)
Misc/NEWS.d/next/Library/2024-07-15-21-43-38.gh-issue-121650.A0FkCh.rst
Outdated
Show resolved
Hide resolved
Co-authored-by: Peter Bierma <[email protected]>
…0FkCh.rst Co-authored-by: Peter Bierma <[email protected]>
I missed headers that were parsed from a message, as in original issue. I updated the fix and the tests. |
There was a problem hiding this comment.
Confirmed that this fixes #121650. I'm pretty sure this is a security fix (as you could previously inject email headers using this method), so this should need a backport all the way to 3.8
|
@warsaw, @bitdancer, @maxking: as the email experts, do you have any comments? |
|
I take back the review. There's more to this, unfortunately :( Here's another reproducer: from email import message_from_string
from email.policy import default
email_in = """\
To: [email protected]
From: External Sender <[email protected]> =?UTF-8?Q?embedded_newline=0A?=Smuggled-Data: Bad
Subject: foo <bar> Here's an
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
<html>
<head><title>An embeded newline</title></head>
<body>
<p>I sent you an embedded newline in the subject. How do you like that?!</p>
</body>
</html>
"""
msg = message_from_string(email_in, policy=default)
print(msg)
for header, value in msg.items():
del msg[header]
msg[header] = value
email_out = str(msg)
print(email_out) |
I'll look into this... |
…com:basbloemsaat/cpython into fix-issue-121650-detect-newlines-in-headers
|
@encukou I tried all header types. This eliminates all newlines. Two notes:
|
|
After reading up on the email module, I propose to fix the issue in a different part of the code: see #122233. |
|
Closing in favour of #122233. |
@encukou as promised, the fix for this issue.
This PR fixes both issues addressed in the issue, both the newlines at the end as well as the encoded newlines.
As this has security implication, it may need to be backported as well.