Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bpo-39073: validate Address parts to disallow CRLF #19007

Merged
merged 8 commits into from Mar 30, 2020
Merged

bpo-39073: validate Address parts to disallow CRLF #19007

merged 8 commits into from Mar 30, 2020

Conversation

@epicfaace
Copy link
Contributor

@epicfaace epicfaace commented Mar 15, 2020 •
edited by bedevere-bot

Validate email.headerregistry.Address to disallow CRLF in address parts (username, domain, display_name)

https://bugs.python.org/issue39073
@epicfaace
validate address parts
38d0a15
@epicfaace epicfaace requested a review from as a code owner Mar 15, 2020
@blurb-it
📜🤖 Added by blurb_it.
d8424e5
bitdancer
bitdancer requested changes Mar 16, 2020
View changes
Copy link
Member

@bitdancer bitdancer left a comment

Thanks for the PR.

Lib/email/headerregistry.py Outdated Show resolved Hide resolved
Lib/test/test_email/test_headerregistry.py Outdated Show resolved Hide resolved
@bedevere-bot
Copy link

@bedevere-bot bedevere-bot commented Mar 16, 2020

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

epicfaace added 2 commits Mar 16, 2020
@epicfaace
do validation at once, on \r and \n, refactor tests
de6ef8c
@epicfaace
Merge branch 'val-address' of github.com:epicfaace/cpython into val-a…
950bd01 
…ddress
epicfaace
epicfaace reviewed Mar 16, 2020
View changes
Copy link
Contributor Author

@epicfaace epicfaace left a comment

I have made the requested changes; please review again

@epicfaace
Copy link
Contributor Author

@epicfaace epicfaace commented Mar 16, 2020

I have made the requested changes; please review again

@bedevere-bot
Copy link

@bedevere-bot bedevere-bot commented Mar 16, 2020

Thanks for making the requested changes!

@bitdancer: please review the changes made to this pull request.

@bedevere-bot bedevere-bot requested a review from bitdancer Mar 16, 2020
@epicfaace
rm extra spacing
6cac3a0
bitdancer
bitdancer requested changes Mar 16, 2020
View changes
Lib/email/headerregistry.py Outdated

inputs = ''.join(filter(None, (display_name, username, domain, addr_spec)))
if '\r' in inputs or '\n' in inputs:
raise ValueError("invalid inputs; address parts cannot contain CR / LF")
Copy link
Member

@bitdancer bitdancer Mar 16, 2020

Hmm. Reading this I think I'd say "arguments" rather than inputs, that aligns better with our typical vocabulary. And how about "CR or LF"?

Lib/test/test_email/test_headerregistry.py Show resolved Hide resolved
@bedevere-bot
Copy link

@bedevere-bot bedevere-bot commented Mar 16, 2020

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

epicfaace added 2 commits Mar 16, 2020
@epicfaace
Add display_name test
d10d383
@epicfaace
update message
81a0231
@epicfaace
Copy link
Contributor Author

@epicfaace epicfaace commented Mar 16, 2020

I have made the requested changes; please review again

@bedevere-bot
Copy link

@bedevere-bot bedevere-bot commented Mar 16, 2020

Thanks for making the requested changes!

@bitdancer: please review the changes made to this pull request.

@bedevere-bot bedevere-bot requested a review from bitdancer Mar 16, 2020
bitdancer
bitdancer requested changes Mar 16, 2020
View changes
Copy link
Member

@bitdancer bitdancer left a comment

Except for the news item text this looks good.

Misc/NEWS.d/next/Security/2020-03-15-01-28-36.bpo-39073.6Szd3i.rst Outdated
@@ -0,0 +1 @@
Validate email.headerregistry.Address to disallow CRLF in address parts (username, domain, display_name).
Copy link
Member

@bitdancer bitdancer Mar 16, 2020

I thought I'd already made this comment but I can't find it:

"DIsallow CR or LF in email.headerregistry.Address arguments to guard against header injection attacks."

@bitdancer bitdancer merged commit 614f172 into python:master Mar 30, 2020
9 checks passed
@bedevere-bot
Copy link

@bedevere-bot bedevere-bot commented Mar 30, 2020

@bitdancer: Please replace # with GH- in the commit message next time. Thanks!

@miss-islington
Copy link
Contributor

@miss-islington miss-islington commented Mar 30, 2020

Thanks @epicfaace for the PR, and @bitdancer for merging it 🌮🎉.. I'm working now to backport this PR to: 3.6, 3.7, 3.8.
🐍🍒⛏🤖

miss-islington added a commit to miss-islington/cpython that referenced this issue Mar 30, 2020
@epicfaace @miss-islington
bpo-39073: validate Address parts to disallow CRLF (pythonGH-19007)
1f49bfb 
 Disallow CR or LF in email.headerregistry.Address arguments to guard against header injection attacks.
(cherry picked from commit 614f172)

Co-authored-by: Ashwin Ramaswami <aramaswamis@gmail.com>
@bedevere-bot
Copy link

@bedevere-bot bedevere-bot commented Mar 30, 2020

GH-19222 is a backport of this pull request to the 3.8 branch.

miss-islington added a commit to miss-islington/cpython that referenced this issue Mar 30, 2020
@epicfaace @miss-islington
bpo-39073: validate Address parts to disallow CRLF (pythonGH-19007)
6c95a89 
 Disallow CR or LF in email.headerregistry.Address arguments to guard against header injection attacks.
(cherry picked from commit 614f172)

Co-authored-by: Ashwin Ramaswami <aramaswamis@gmail.com>
@bedevere-bot
Copy link

@bedevere-bot bedevere-bot commented Mar 30, 2020

GH-19223 is a backport of this pull request to the 3.7 branch.

@bedevere-bot
Copy link

@bedevere-bot bedevere-bot commented Mar 30, 2020

GH-19224 is a backport of this pull request to the 3.6 branch.

miss-islington added a commit to miss-islington/cpython that referenced this issue Mar 30, 2020
@epicfaace @miss-islington
bpo-39073: validate Address parts to disallow CRLF (pythonGH-19007)
b0041a9 
 Disallow CR or LF in email.headerregistry.Address arguments to guard against header injection attacks.
(cherry picked from commit 614f172)

Co-authored-by: Ashwin Ramaswami <aramaswamis@gmail.com>
miss-islington added a commit that referenced this issue May 27, 2020
@epicfaace @miss-islington
bpo-39073: validate Address parts to disallow CRLF (GH-19007)
75635c6 
 Disallow CR or LF in email.headerregistry.Address arguments to guard against header injection attacks.
(cherry picked from commit 614f172)

Co-authored-by: Ashwin Ramaswami <aramaswamis@gmail.com>
miss-islington added a commit that referenced this issue May 27, 2020
@epicfaace @miss-islington
bpo-39073: validate Address parts to disallow CRLF (GH-19007)
a93bf82 
 Disallow CR or LF in email.headerregistry.Address arguments to guard against header injection attacks.
(cherry picked from commit 614f172)

Co-authored-by: Ashwin Ramaswami <aramaswamis@gmail.com>
vstinner added a commit to vstinner/cpython that referenced this issue May 27, 2020
@epicfaace @vstinner
bpo-39073: validate Address parts to disallow CRLF (python#19007)
1ddbb52 
 Disallow CR or LF in email.headerregistry.Address arguments to guard against header injection attacks.

(cherry picked from commit 614f172)
@epicfaace epicfaace deleted the val-address branch May 27, 2020
ned-deily pushed a commit that referenced this issue May 27, 2020
@epicfaace @miss-islington
bpo-39073: validate Address parts to disallow CRLF (GH-19007) (#19224)
7df32f8 
Disallow CR or LF in email.headerregistry.Address arguments to guard against header injection attacks.
(cherry picked from commit 614f172)

Co-authored-by: Ashwin Ramaswami <aramaswamis@gmail.com>

Co-authored-by: Ashwin Ramaswami <aramaswamis@gmail.com>
vegerot added a commit to vegerot/cpython that referenced this issue Jun 10, 2020
@epicfaace @vegerot
bpo-39073: validate Address parts to disallow CRLF (python#19007)
192f60e 
 Disallow CR or LF in email.headerregistry.Address arguments to guard against header injection attacks.
vegerot added a commit to vegerot/cpython that referenced this issue Jun 10, 2020
@epicfaace @vegerot
bpo-39073: validate Address parts to disallow CRLF (python#19007)
a1abeac 
 Disallow CR or LF in email.headerregistry.Address arguments to guard against header injection attacks.
larryhastings pushed a commit that referenced this issue Jun 12, 2020
@vstinner
bpo-39073: validate Address parts to disallow CRLF (#19007) (#20450)
f91a0b6 
Disallow CR or LF in email.headerregistry.Address arguments to guard against header injection attacks.

(cherry picked from commit 614f172)
gmelikov added a commit to gmelikov/cpython that referenced this issue Aug 22, 2020
@epicfaace @gmelikov
bpo-39073: validate Address parts to disallow CRLF (python#19007)
d2db759 
 Disallow CR or LF in email.headerregistry.Address arguments to guard against header injection attacks.
chrisburr added a commit to chrisburr/cpython that referenced this issue Dec 9, 2020
@epicfaace @chrisburr
bpo-39073: validate Address parts to disallow CRLF (python#19007)
4a8ecce 
 Disallow CR or LF in email.headerregistry.Address arguments to guard against header injection attacks.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@bitdancer bitdancer

Assignees
No one assigned
Labels
CLA signed type-security
Projects
None yet
Milestone
No milestone
5 participants
@epicfaace @bedevere-bot @miss-islington @bitdancer @the-knights-who-say-ni