[2.7] bpo-34155: Dont parse domains containing @ (GH-13079) #16006
Conversation
https://bugs.python.org/issue34155 (cherry picked from commit 8cb65d1) Excludes changes to Lib/email/_header_value_parser.py, which did not exist in 2.7. Co-authored-by: jpic <jpic@users.noreply.github.com>
|
Hello, and thanks for your contribution! I'm a bot set up to make sure that the project can legally accept this contribution by verifying everyone involved has signed the PSF contributor agreement (CLA). Recognized GitHub usernameWe couldn't find a bugs.python.org (b.p.o) account corresponding to the following GitHub usernames: This might be simply due to a missing "GitHub Name" entry in one's b.p.o account settings. This is necessary for legal reasons before we can look at this contribution. Please follow the steps outlined in the CPython devguide to rectify this issue. You can check yourself to see if the CLA has been received. Thanks again for the contribution, we look forward to reviewing it! |
|
@rcsanchez97: Can you please sign the CLA? See the previous comment for the procedure. |
|
@vstinner That is very strange. I signed the CLA at the same time I created the PR. However, the |
There was a problem hiding this comment.
LGTM. But I would prefer to have a double check from another core dev.
@maxking or @warsaw: Can you please review this PR?
I compared with 8cb65d1 : the code looks the same. The 2.7 backport lacks the get_domain() change which raises HeaderParseError: Python 2.7 doens't have the parser.get_addr_spec() function, so I understand that it doesn't need this change.
There was a problem hiding this comment.
LGTM!
Thank @rcsanchez97 for the backport and @vstinner for helping review.
This change skips parsing of email addresses where domains include a "@" character, which can be maliciously used since the local part is returned as a complete address.
(cherry picked from commit 8cb65d1)
Excludes changes to Lib/email/_header_value_parser.py, which did not
exist in 2.7.
Co-authored-by: jpic jpic@users.noreply.github.com
https://bugs.python.org/issue34155
Automerge-Triggered-By: @maxking