SHA256
1
0
forked from pool/python312
Matej Cepl 2024-02-12 13:36:22 +00:00 committed by Git OBS Bridge
parent 3e5f9031be
commit 600a900c7b

View File

@ -11,16 +11,13 @@ Thomas Dwyer.
Co-Authored-By: Thomas Dwyer <github@tomd.tel> Co-Authored-By: Thomas Dwyer <github@tomd.tel>
--- ---
Doc/library/email.utils.rst | 19 +- Doc/library/email.utils.rst | 19 -
Doc/whatsnew/3.13.rst | 13 ++ Lib/email/utils.py | 151 +++++++-
Lib/email/utils.py | 151 +++++++++++++- Lib/test/test_email/test_email.py | 187 +++++++++-
Lib/test/test_email/test_email.py | 187 +++++++++++++++++- Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst | 8
...-10-20-15-28-08.gh-issue-102988.dStNO7.rst | 8 + 4 files changed, 344 insertions(+), 21 deletions(-)
5 files changed, 357 insertions(+), 21 deletions(-)
create mode 100644 Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst create mode 100644 Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst
diff --git a/Doc/library/email.utils.rst b/Doc/library/email.utils.rst
index 345b64001c1ace..d693a9bc3933b5 100644
--- a/Doc/library/email.utils.rst --- a/Doc/library/email.utils.rst
+++ b/Doc/library/email.utils.rst +++ b/Doc/library/email.utils.rst
@@ -58,13 +58,18 @@ of the new API. @@ -58,13 +58,18 @@ of the new API.
@ -72,35 +69,9 @@ index 345b64001c1ace..d693a9bc3933b5 100644
.. function:: parsedate(date) .. function:: parsedate(date)
diff --git a/Doc/whatsnew/3.13.rst b/Doc/whatsnew/3.13.rst
index e22257853d8333..4f9643967d20cf 100644
--- a/Doc/whatsnew/3.13.rst
+++ b/Doc/whatsnew/3.13.rst
@@ -199,6 +199,19 @@ doctest
:attr:`doctest.TestResults.skipped` attributes.
(Contributed by Victor Stinner in :gh:`108794`.)
+email
+-----
+
+* :func:`email.utils.getaddresses` and :func:`email.utils.parseaddr` now return
+ ``('', '')`` 2-tuples in more situations where invalid email addresses are
+ encountered instead of potentially inaccurate values. Add optional *strict*
+ parameter to these two functions: use ``strict=False`` to get the old
+ behavior, accept malformed inputs.
+ ``getattr(email.utils, 'supports_strict_parsing', False)`` can be use to
+ check if the *strict* paramater is available.
+ (Contributed by Thomas Dwyer and Victor Stinner for :gh:`102988` to improve
+ the CVE-2023-27043 fix.)
+
glob
----
diff --git a/Lib/email/utils.py b/Lib/email/utils.py
index 9175f2fdb6e69e..103cef61a83538 100644
--- a/Lib/email/utils.py --- a/Lib/email/utils.py
+++ b/Lib/email/utils.py +++ b/Lib/email/utils.py
@@ -43,6 +43,7 @@ @@ -48,6 +48,7 @@ TICK = "'"
specialsre = re.compile(r'[][\\()<>@,:;".]') specialsre = re.compile(r'[][\\()<>@,:;".]')
escapesre = re.compile(r'[\\"]') escapesre = re.compile(r'[\\"]')
@ -108,7 +79,7 @@ index 9175f2fdb6e69e..103cef61a83538 100644
def _has_surrogates(s): def _has_surrogates(s):
"""Return True if s may contain surrogate-escaped binary data.""" """Return True if s may contain surrogate-escaped binary data."""
# This check is based on the fact that unless there are surrogates, utf8 # This check is based on the fact that unless there are surrogates, utf8
@@ -103,12 +104,127 @@ def formataddr(pair, charset='utf-8'): @@ -106,12 +107,127 @@ def formataddr(pair, charset='utf-8'):
return address return address
@ -145,17 +116,17 @@ index 9175f2fdb6e69e..103cef61a83538 100644
+ result.append(addr[start:open_pos]) + result.append(addr[start:open_pos])
+ start = pos + 1 + start = pos + 1
+ open_pos = None + open_pos = None
+
+ if start < len(addr):
+ result.append(addr[start:])
+
+ return ''.join(result)
-def getaddresses(fieldvalues): -def getaddresses(fieldvalues):
- """Return a list of (REALNAME, EMAIL) for each fieldvalue.""" - """Return a list of (REALNAME, EMAIL) for each fieldvalue."""
- all = COMMASPACE.join(str(v) for v in fieldvalues) - all = COMMASPACE.join(str(v) for v in fieldvalues)
- a = _AddressList(all) - a = _AddressList(all)
- return a.addresslist - return a.addresslist
+ if start < len(addr):
+ result.append(addr[start:])
+
+ return ''.join(result)
+
+ +
+supports_strict_parsing = True +supports_strict_parsing = True
+ +
@ -241,7 +212,7 @@ index 9175f2fdb6e69e..103cef61a83538 100644
def _format_timetuple_and_zone(timetuple, zone): def _format_timetuple_and_zone(timetuple, zone):
@@ -207,16 +323,33 @@ def parsedate_to_datetime(data): @@ -205,16 +321,33 @@ def parsedate_to_datetime(data):
tzinfo=datetime.timezone(datetime.timedelta(seconds=tz))) tzinfo=datetime.timezone(datetime.timedelta(seconds=tz)))
@ -279,11 +250,9 @@ index 9175f2fdb6e69e..103cef61a83538 100644
return addrs[0] return addrs[0]
diff --git a/Lib/test/test_email/test_email.py b/Lib/test/test_email/test_email.py
index 512464f87162cd..39d4ace8d4a1d8 100644
--- a/Lib/test/test_email/test_email.py --- a/Lib/test/test_email/test_email.py
+++ b/Lib/test/test_email/test_email.py +++ b/Lib/test/test_email/test_email.py
@@ -16,6 +16,7 @@ @@ -16,6 +16,7 @@ from unittest.mock import patch
import email import email
import email.policy import email.policy
@ -291,7 +260,7 @@ index 512464f87162cd..39d4ace8d4a1d8 100644
from email.charset import Charset from email.charset import Charset
from email.generator import Generator, DecodedGenerator, BytesGenerator from email.generator import Generator, DecodedGenerator, BytesGenerator
@@ -3337,15 +3338,137 @@ def test_getaddresses_comma_in_name(self): @@ -3337,15 +3338,137 @@ Foo
], ],
) )
@ -437,7 +406,7 @@ index 512464f87162cd..39d4ace8d4a1d8 100644
def test_getaddresses_embedded_comment(self): def test_getaddresses_embedded_comment(self):
"""Test proper handling of a nested comment""" """Test proper handling of a nested comment"""
@@ -3536,6 +3659,54 @@ def test_mime_classes_policy_argument(self): @@ -3536,6 +3659,54 @@ multipart/report
m = cls(*constructor, policy=email.policy.default) m = cls(*constructor, policy=email.policy.default)
self.assertIs(m.policy, email.policy.default) self.assertIs(m.policy, email.policy.default)
@ -492,9 +461,6 @@ index 512464f87162cd..39d4ace8d4a1d8 100644
# Test the iterator/generators # Test the iterator/generators
class TestIterators(TestEmailBase): class TestIterators(TestEmailBase):
diff --git a/Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst b/Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst
new file mode 100644
index 00000000000000..3d0e9e4078c934
--- /dev/null --- /dev/null
+++ b/Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst +++ b/Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst
@@ -0,0 +1,8 @@ @@ -0,0 +1,8 @@