gh-121650 : detect newlines in headers - #121812
Conversation
Sorry, something went wrong.
ZeroIntensity
left a comment
There was a problem hiding this comment.
I wasn't able to confirm that this PR fixes #121650. The original reproducer still contains the embedded newline:
from email import message_from_string
from email.policy import default
email_in = """\
To: incoming+tag@me.example.com
From: External Sender <sender@them.example.com>
Subject: Here's an =?UTF-8?Q?embedded_newline=0A?=
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
<html>
<head><title>An embeded newline</title></head>
<body>
<p>I sent you an embedded newline in the subject. How do you like that?!</p>
</body>
</html>
"""
msg = message_from_string(email_in, policy=default)
msg = message_from_string(email_in, policy=default)
for header, value in msg.items():
del msg[header]
msg[header] = value
email_out = str(msg)
print(email_out)
Sorry, something went wrong.
Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
…0FkCh.rst Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
I missed headers that were parsed from a message, as in original issue. I updated the fix and the tests. |
Sorry, something went wrong.
ZeroIntensity
left a comment
There was a problem hiding this comment.
Confirmed that this fixes #121650. I'm pretty sure this is a security fix (as you could previously inject email headers using this method), so this should need a backport all the way to 3.8
Sorry, something went wrong.
|
@warsaw, @bitdancer, @maxking: as the email experts, do you have any comments? |
Sorry, something went wrong.
encukou
left a comment
There was a problem hiding this comment.
The fix looks good to me! Thank you for digging into it!
Sorry, something went wrong.
|
I take back the review. There's more to this, unfortunately :( Here's another reproducer: from email import message_from_string
from email.policy import default
email_in = """\
To: incoming+tag@me.example.com
From: External Sender <sender@them.example.com> =?UTF-8?Q?embedded_newline=0A?=Smuggled-Data: Bad
Subject: foo <bar> Here's an
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
<html>
<head><title>An embeded newline</title></head>
<body>
<p>I sent you an embedded newline in the subject. How do you like that?!</p>
</body>
</html>
"""
msg = message_from_string(email_in, policy=default)
print(msg)
for header, value in msg.items():
del msg[header]
msg[header] = value
email_out = str(msg)
print(email_out) |
Sorry, something went wrong.
I'll look into this... |
Sorry, something went wrong.
…com:basbloemsaat/cpython into fix-issue-121650-detect-newlines-in-headers
|
@encukou I tried all header types. This eliminates all newlines. Two notes:
|
Sorry, something went wrong.
|
After reading up on the email module, I propose to fix the issue in a different part of the code: see #122233. |
Sorry, something went wrong.
|
Closing in favour of #122233. |
Sorry, something went wrong.
@encukou as promised, the fix for this issue.
This PR fixes both issues addressed in the issue, both the newlines at the end as well as the encoded newlines.
As this has security implication, it may need to be backported as well.