forked from pool/python314
Matěj Cepl
a667dcdda9
- CVE-2025-11468-email-hdr-fold-comment.patch - CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
42 lines
2.2 KiB
Diff
42 lines
2.2 KiB
Diff
From 5a8bfd878f086e28f0849bbc3970ad92f6ba37dc Mon Sep 17 00:00:00 2001
|
|
From: Seth Michael Larson <seth@python.org>
|
|
Date: Fri, 23 Jan 2026 08:59:35 -0600
|
|
Subject: [PATCH] gh-144125: email: verify headers are sound in BytesGenerator
|
|
(cherry picked from commit 052e55e7d44718fe46cbba0ca995cb8fcc359413)
|
|
|
|
Co-authored-by: Seth Michael Larson <seth@python.org>
|
|
Co-authored-by: Denis Ledoux <dle@odoo.com>
|
|
Co-authored-by: Denis Ledoux <5822488+beledouxdenis@users.noreply.github.com>
|
|
Co-authored-by: Petr Viktorin <302922+encukou@users.noreply.github.com>
|
|
Co-authored-by: Bas Bloemsaat <1586868+basbloemsaat@users.noreply.github.com>
|
|
---
|
|
Lib/test/test_email/test_policy.py | 4 ++++
|
|
Misc/NEWS.d/next/Security/2026-01-21-12-34-05.gh-issue-144125.TAz5uo.rst | 4 ++++
|
|
2 files changed, 8 insertions(+)
|
|
create mode 100644 Misc/NEWS.d/next/Security/2026-01-21-12-34-05.gh-issue-144125.TAz5uo.rst
|
|
|
|
Index: Python-3.14.3/Lib/test/test_email/test_policy.py
|
|
===================================================================
|
|
--- Python-3.14.3.orig/Lib/test/test_email/test_policy.py 2026-02-03 16:32:20.000000000 +0100
|
|
+++ Python-3.14.3/Lib/test/test_email/test_policy.py 2026-02-13 17:09:32.641745760 +0100
|
|
@@ -323,6 +323,10 @@
|
|
message.as_bytes(),
|
|
f"{text}\nBody".encode(),
|
|
)
|
|
+ self.assertEqual(
|
|
+ message.as_bytes(),
|
|
+ f"{text}\nBody".encode(),
|
|
+ )
|
|
|
|
# XXX: Need subclassing tests.
|
|
# For adding subclassed objects, make sure the usual rules apply (subclass
|
|
Index: Python-3.14.3/Misc/NEWS.d/next/Security/2026-01-21-12-34-05.gh-issue-144125.TAz5uo.rst
|
|
===================================================================
|
|
--- /dev/null 1970-01-01 00:00:00.000000000 +0000
|
|
+++ Python-3.14.3/Misc/NEWS.d/next/Security/2026-01-21-12-34-05.gh-issue-144125.TAz5uo.rst 2026-02-13 17:09:32.642152246 +0100
|
|
@@ -0,0 +1,4 @@
|
|
+:mod:`~email.generator.BytesGenerator` will now refuse to serialize (write) headers
|
|
+that are unsafely folded or delimited; see
|
|
+:attr:`~email.policy.Policy.verify_generated_headers`. (Contributed by Bas
|
|
+Bloemsaat and Petr Viktorin in :gh:`121650`).
|