Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

email.utils.getaddresses() rejects email addresses with "," in name #106669

Closed
felixxm opened this issue Jul 12, 2023 · 5 comments
Closed

email.utils.getaddresses() rejects email addresses with "," in name #106669

felixxm opened this issue Jul 12, 2023 · 5 comments
Assignees
@gpshead
Labels
3.12 bugs and security fixes 3.13 new features, bugs and security fixes release-blocker topic-email type-bug An unexpected behavior, bug, or error

Comments

@felixxm
Copy link
Contributor

felixxm commented Jul 12, 2023 •
edited by bedevere-bot

Bug report

email.utils.getaddresses() returns ('', '') for email addresses with , in a real name, e.g.

>>> from email.utils import getaddresses
>>> getaddresses(('"Sürname, Firstname" <to@example.com>',))
[('', '')]

Regression in 18dfbd0.

Your environment

  • CPython versions tested on: 3.12.0b4
  • Operating system and architecture: x86_64 GNU/Linux

Linked PRs
@felixxm felixxm added the type-bug An unexpected behavior, bug, or error label Jul 12, 2023
@felixxm
Copy link
Contributor Author

felixxm commented Jul 12, 2023

A regression test:

diff --git a/Lib/test/test_email/test_email.py b/Lib/test/test_email/test_email.py
index 5238944d6b..30ade53a9a 100644
--- a/Lib/test/test_email/test_email.py
+++ b/Lib/test/test_email/test_email.py
@@ -3319,6 +3319,22 @@ def test_getaddresses(self):
            [('Al Person', 'aperson@dom.ain'),
             ('Bud Person', 'bperson@dom.ain')])
 
+    def test_getaddresses_comma_in_name(self):
+        self.assertEqual(
+            utils.getaddresses(
+                [
+                    '"Bud, Person" <bperson@dom.ain>',
+                    'aperson@dom.ain (Al Person)',
+                    '"Mariusz Felisiak" <to@example.com>',
+                ]
+            ),
+            [
+                ('Bud Person', 'bperson@dom.ain'),
+                ('Al Person', 'aperson@dom.ain'),
+                ('Mariusz Felisiak', 'to@example.com'),
+            ],
+        )
+
     def test_getaddresses_parsing_errors(self):
         """Test for parsing errors from CVE-2023-27043"""
         eq = self.assertEqual

@AlexWaygood AlexWaygood added topic-email 3.12 bugs and security fixes 3.13 new features, bugs and security fixes labels Jul 12, 2023
This was referenced Jul 12, 2023
Open
Merged
@rouilj
Copy link

rouilj commented Jul 13, 2023

Thanks for finding this. It blew up the regression testing for the Roundup Issue Tracker during my release yesterday. Specifically for:

email.utils.getaddresses(['"Bork, Chef" chef@bork.bork.bork'])
[('', '')]

Any idea if there will be a beta-5 to fix this? If not I could use some ideas on how to
handle/decorate the three tests that are failing when run on 3.12.

Thanks.

gpshead added a commit to gpshead/cpython that referenced this issue Jul 14, 2023
@gpshead
pythongh-106669: Revert "pythongh-102988: Detect email address parsin…
362793e 
…g errors and return empty tuple to indicate the parsing error (old API) (python#105127)"

This reverts commit 18dfbd0.

See python#106669.
@gpshead gpshead mentioned this issue Jul 14, 2023
Merged
@gpshead
Copy link
Member

gpshead commented Jul 14, 2023

If you add a test skip decorator, I'd do it specifically for 3.12beta4. Something like this:

@unittest.skipIf(sys.version_info == (3, 12, 0, 'beta', 4), "https://github.com/python/cpython/issues/106669")
def test_oops(self): ...

It does not look like there is an easy acceptable workaround for the bug as the source of the problem appears to be the comma counting logic added near the end of email.utils.getaddresses().

It's up to @Yhg1s to decide if this warrants a beta5 or not. I've prepared a rollback of the change that caused it.

@felixxm felixxm mentioned this issue Jul 17, 2023
Merged
gpshead added a commit that referenced this issue Jul 21, 2023
@gpshead
gh-106669: Revert "gh-102988: Detect email address parsing errors ... (…
a31dea1 
…#105127)" (#106733)

This reverts commit 18dfbd0.
Adds a regression test from the issue.

See #106669.
gpshead added a commit to gpshead/cpython that referenced this issue Jul 21, 2023
@gpshead
[3.12] pythongh-106669: Revert "pythongh-102988: Detect email address…
4288c62 
… parsing errors ... (pythonGH-105127)" (pythonGH-106733)

This reverts commit 18dfbd0.
Adds a regression test from the issue.

See python#106669..
(cherry picked from commit a31dea1)

Co-authored-by: Gregory P. Smith <greg@krypto.org>
@gpshead gpshead mentioned this issue Jul 21, 2023
Merged
gpshead added a commit that referenced this issue Jul 21, 2023
@gpshead
[3.12] gh-106669: Revert "gh-102988: Detect email address parsing err…
656f624 
…ors ... (GH-105127)" (GH-106733) (#106941)

This reverts commit 18dfbd0.
Adds a regression test from the issue.

See #106669..
(cherry picked from commit a31dea1)
@michel-slm
Copy link

This also breaks b4 very similarly to Django; mentioning here for reference

https://bugzilla.redhat.com/show_bug.cgi?id=2226159

    def test_header_wrapping(sampledir, hval, verify, tr):
        hname = 'To' if '@' in hval else "X-Header"
        wrapped = b4.LoreMessage.wrap_header((hname, hval), transform=tr)
>       assert wrapped.decode() == f'{hname}: {verify}'
E       assert 'To: ' == 'To: foo@exam...@example.com>'
E         + To: 
E         - To: foo@example.com, Foo Bar <bar@example.com>, 
E         -  =?utf-8?q?F=C3=B4o_Baz?= <baz@example.com>, "Quux, Foo" <quux@example.com>
tests/test___init__.py:171: AssertionError

@gpshead
Copy link
Member

gpshead commented Jul 26, 2023

The rollbacks were merged and will appear in 3.12.0rc1.

@gpshead gpshead closed this as completed Jul 26, 2023
bmwiedemann pushed a commit to bmwiedemann/openSUSE that referenced this issue Jul 27, 2023
@bmwiedemann
Update python39 to version 3.9.17 / rev 47 via SR 1100886
fb07387 
https://build.opensuse.org/request/show/1100886
by user mcepl + anag+factory
- Add gh-78214-marshal_stabilize_FLAG_REF.patch to marshal.c for
  stabilizing FLAG_REF usage (required for reproduceability;
  bsc#1213463).
- Revert faulty fix for CVE-2023-27043 (gh#python/cpython#106669)
bmwiedemann pushed a commit to bmwiedemann/openSUSE that referenced this issue Aug 4, 2023
@bmwiedemann
Update python38 to version 3.8.17 / rev 39 via SR 1102235
61b9ace 
https://build.opensuse.org/request/show/1102235
by user mcepl + dimstar_suse
- IT MEANS THAT bsc#1210638 STILL HAS NOT BEEN FIXED!
- Add Revert-gh105127-left-tests.patch (gh#python/cpython!106941)
  partially reverting CVE-2023-27043-email-parsing-errors.patch,
  because of the regression in gh#python/cpython#106669.
- (bsc#1210638, CVE-2023-27043) Add
  CVE-2023-27043-email-parsing-errors.patch, which detects email
  address parsing errors and returns empty tuple to indicate the
  parsing error (old API). (The patch is faulty,
  gh#python/cpython#106669, but upstream decided not to just
  revert it).
bmwiedemann pushed a commit to bmwiedemann/openSUSE that referenced this issue Aug 4, 2023
@bmwiedemann
Update python312 to version 3.12.0b4 / rev 5 via SR 1102238
0bfafc7 
https://build.opensuse.org/request/show/1102238
by user mcepl + dimstar_suse
- IT MEANS THAT bsc#1210638 STILL HAS NOT BEEN FIXED!
- Add Revert-gh105127-left-tests.patch (gh#python/cpython!106941)
  partially reverting CVE-2023-27043-email-parsing-errors.patch,
  because of the regression in gh#python/cpython#106669.
bmwiedemann pushed a commit to bmwiedemann/openSUSE that referenced this issue Aug 6, 2023
@bmwiedemann
Update python310 to version 3.10.12 / rev 35 via SR 1102193
55c5f8a 
https://build.opensuse.org/request/show/1102193
by user mcepl + dimstar_suse
- Add Revert-gh105127-left-tests.patch (gh#python/cpython!106941)
  partially reverting CVE-2023-27043-email-parsing-errors.patch,
  because of the regression in gh#python/cpython#106669.
bmwiedemann pushed a commit to bmwiedemann/openSUSE that referenced this issue Aug 6, 2023
@bmwiedemann
Update python39 to version 3.9.17 / rev 49 via SR 1102236
ef4b44f 
https://build.opensuse.org/request/show/1102236
by user mcepl + dimstar_suse
- IT MEANS THAT bsc#1210638 STILL HAS NOT BEEN FIXED!
- Add Revert-gh105127-left-tests.patch (gh#python/cpython!106941)
  partially reverting CVE-2023-27043-email-parsing-errors.patch,
  because of the regression in gh#python/cpython#106669.
- (bsc#1210638, CVE-2023-27043) Add
  CVE-2023-27043-email-parsing-errors.patch, which detects email
  address parsing errors and returns empty tuple to indicate the
  parsing error (old API). (The patch is faulty,
  gh#python/cpython#106669, but upstream decided not to just
  revert it).
bmwiedemann pushed a commit to bmwiedemann/openSUSE that referenced this issue Aug 6, 2023
@bmwiedemann
Update python311 to version 3.11.4 / rev 21 via SR 1102237
c4336af 
https://build.opensuse.org/request/show/1102237
by user mcepl + dimstar_suse
- IT MEANS THAT bsc#1210638 STILL HAS NOT BEEN FIXED!
- Add Revert-gh105127-left-tests.patch (gh#python/cpython!106941)
  partially reverting CVE-2023-27043-email-parsing-errors.patch,
  because of the regression in gh#python/cpython#106669.
- (bsc#1210638, CVE-2023-27043) Add
  CVE-2023-27043-email-parsing-errors.patch, which detects email
  address parsing errors and returns empty tuple to indicate the
  parsing error (old API). (The patch is faulty,
  gh#python/cpython#106669, but upstream decided not to just
  revert it).
bmwiedemann pushed a commit to bmwiedemann/openSUSE that referenced this issue Aug 15, 2023
@bmwiedemann
Update python to version 2.7.18 / rev 186 via SR 1103620
50cde6e 
https://build.opensuse.org/request/show/1103620
by user mcepl + dimstar_suse
- IT MEANS THAT bsc#1210638 STILL HAS NOT BEEN FIXED!
- Add Revert-gh105127-left-tests.patch (gh#python/cpython!106941)
  partially reverting CVE-2023-27043-email-parsing-errors.patch,
  because of the regression in gh#python/cpython#106669.
- (bsc#1210638, CVE-2023-27043) Add
  CVE-2023-27043-email-parsing-errors.patch, which detects email
  address parsing errors and returns empty tuple to indicate the
  parsing error (old API).
- IT MEANS THAT bsc#1210638 STILL HAS NOT BEEN FIXED!
- Add Revert-gh105127-left-tests.patch (gh#python/cpython!106941)
  partially reverting CVE-2023-27043-email-parsing-errors.patch,
  because of the regression in gh#python/cpython#106669.
- (bsc#1210638, CVE-2023-27043) Add
  CVE-2023-27043-email-parsing-errors.patch, which detects email
  address parsing error
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@gpshead gpshead

Labels
3.12 bugs and security fixes 3.13 new features, bugs and security fixes release-blocker topic-email type-bug An unexpected behavior, bug, or error
Projects
Release and Deferred blockers
Archived in project
Milestone
No milestone
Development

No branches or pull requests
5 participants
@gpshead @michel-slm @felixxm @rouilj @AlexWaygood