diff --git a/CVE-2023-27043-email-parsing-errors.patch b/CVE-2023-27043-email-parsing-errors.patch index ac8a195..ca22afa 100644 --- a/CVE-2023-27043-email-parsing-errors.patch +++ b/CVE-2023-27043-email-parsing-errors.patch @@ -11,16 +11,13 @@ Thomas Dwyer. Co-Authored-By: Thomas Dwyer --- - Doc/library/email.utils.rst | 19 +- - Doc/whatsnew/3.13.rst | 13 ++ - Lib/email/utils.py | 151 +++++++++++++- - Lib/test/test_email/test_email.py | 187 +++++++++++++++++- - ...-10-20-15-28-08.gh-issue-102988.dStNO7.rst | 8 + - 5 files changed, 357 insertions(+), 21 deletions(-) + Doc/library/email.utils.rst | 19 - + Lib/email/utils.py | 151 +++++++- + Lib/test/test_email/test_email.py | 187 +++++++++- + Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst | 8 + 4 files changed, 344 insertions(+), 21 deletions(-) create mode 100644 Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst -diff --git a/Doc/library/email.utils.rst b/Doc/library/email.utils.rst -index 345b64001c1ace..d693a9bc3933b5 100644 --- a/Doc/library/email.utils.rst +++ b/Doc/library/email.utils.rst @@ -58,13 +58,18 @@ of the new API. @@ -72,35 +69,9 @@ index 345b64001c1ace..d693a9bc3933b5 100644 .. function:: parsedate(date) -diff --git a/Doc/whatsnew/3.13.rst b/Doc/whatsnew/3.13.rst -index e22257853d8333..4f9643967d20cf 100644 ---- a/Doc/whatsnew/3.13.rst -+++ b/Doc/whatsnew/3.13.rst -@@ -199,6 +199,19 @@ doctest - :attr:`doctest.TestResults.skipped` attributes. - (Contributed by Victor Stinner in :gh:`108794`.) - -+email -+----- -+ -+* :func:`email.utils.getaddresses` and :func:`email.utils.parseaddr` now return -+ ``('', '')`` 2-tuples in more situations where invalid email addresses are -+ encountered instead of potentially inaccurate values. Add optional *strict* -+ parameter to these two functions: use ``strict=False`` to get the old -+ behavior, accept malformed inputs. -+ ``getattr(email.utils, 'supports_strict_parsing', False)`` can be use to -+ check if the *strict* paramater is available. -+ (Contributed by Thomas Dwyer and Victor Stinner for :gh:`102988` to improve -+ the CVE-2023-27043 fix.) -+ - glob - ---- - -diff --git a/Lib/email/utils.py b/Lib/email/utils.py -index 9175f2fdb6e69e..103cef61a83538 100644 --- a/Lib/email/utils.py +++ b/Lib/email/utils.py -@@ -43,6 +43,7 @@ +@@ -48,6 +48,7 @@ TICK = "'" specialsre = re.compile(r'[][\\()<>@,:;".]') escapesre = re.compile(r'[\\"]') @@ -108,7 +79,7 @@ index 9175f2fdb6e69e..103cef61a83538 100644 def _has_surrogates(s): """Return True if s may contain surrogate-escaped binary data.""" # This check is based on the fact that unless there are surrogates, utf8 -@@ -103,12 +104,127 @@ def formataddr(pair, charset='utf-8'): +@@ -106,12 +107,127 @@ def formataddr(pair, charset='utf-8'): return address @@ -145,17 +116,17 @@ index 9175f2fdb6e69e..103cef61a83538 100644 + result.append(addr[start:open_pos]) + start = pos + 1 + open_pos = None -+ -+ if start < len(addr): -+ result.append(addr[start:]) -+ -+ return ''.join(result) -def getaddresses(fieldvalues): - """Return a list of (REALNAME, EMAIL) for each fieldvalue.""" - all = COMMASPACE.join(str(v) for v in fieldvalues) - a = _AddressList(all) - return a.addresslist ++ if start < len(addr): ++ result.append(addr[start:]) ++ ++ return ''.join(result) ++ + +supports_strict_parsing = True + @@ -241,7 +212,7 @@ index 9175f2fdb6e69e..103cef61a83538 100644 def _format_timetuple_and_zone(timetuple, zone): -@@ -207,16 +323,33 @@ def parsedate_to_datetime(data): +@@ -205,16 +321,33 @@ def parsedate_to_datetime(data): tzinfo=datetime.timezone(datetime.timedelta(seconds=tz))) @@ -279,11 +250,9 @@ index 9175f2fdb6e69e..103cef61a83538 100644 return addrs[0] -diff --git a/Lib/test/test_email/test_email.py b/Lib/test/test_email/test_email.py -index 512464f87162cd..39d4ace8d4a1d8 100644 --- a/Lib/test/test_email/test_email.py +++ b/Lib/test/test_email/test_email.py -@@ -16,6 +16,7 @@ +@@ -16,6 +16,7 @@ from unittest.mock import patch import email import email.policy @@ -291,7 +260,7 @@ index 512464f87162cd..39d4ace8d4a1d8 100644 from email.charset import Charset from email.generator import Generator, DecodedGenerator, BytesGenerator -@@ -3337,15 +3338,137 @@ def test_getaddresses_comma_in_name(self): +@@ -3337,15 +3338,137 @@ Foo ], ) @@ -437,7 +406,7 @@ index 512464f87162cd..39d4ace8d4a1d8 100644 def test_getaddresses_embedded_comment(self): """Test proper handling of a nested comment""" -@@ -3536,6 +3659,54 @@ def test_mime_classes_policy_argument(self): +@@ -3536,6 +3659,54 @@ multipart/report m = cls(*constructor, policy=email.policy.default) self.assertIs(m.policy, email.policy.default) @@ -492,9 +461,6 @@ index 512464f87162cd..39d4ace8d4a1d8 100644 # Test the iterator/generators class TestIterators(TestEmailBase): -diff --git a/Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst b/Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst -new file mode 100644 -index 00000000000000..3d0e9e4078c934 --- /dev/null +++ b/Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst @@ -0,0 +1,8 @@