Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[CVE-2023-27043] gh-102988: Reject malformed addresses in email.parseaddr() #111116

Merged
merged 14 commits into from
Dec 15, 2023
Merged

[CVE-2023-27043] gh-102988: Reject malformed addresses in email.parseaddr() #111116

merged 14 commits into from
Dec 15, 2023

Commits on Dec 5, 2023

  1. pythongh-102988: email parseaddr() now rejects malformed address 

    Detect email address parsing errors and return empty tuple to
indicate the parsing error (old API). Add an optional 'strict'
parameter to getaddresses() and parseaddr() functions. Patch by
Thomas Dwyer.

Co-Authored-By: Thomas Dwyer <github@tomd.tel>
    @vstinner @tdwyer
    vstinner and tdwyer committed Dec 5, 2023
    Configuration menu
    Copy the full SHA
    663910d View commit details
    Browse the repository at this point in the history

  2. Fast path

    @vstinner
    vstinner committed Dec 5, 2023
    Configuration menu
    Copy the full SHA
    730500c View commit details
    Browse the repository at this point in the history

  3. Handle escaped quotes

    @vstinner
    vstinner committed Dec 5, 2023
    Configuration menu
    Copy the full SHA
    1a377ec View commit details
    Browse the repository at this point in the history

  4. Check parenthesis

    @vstinner
    vstinner committed Dec 5, 2023
    Configuration menu
    Copy the full SHA
    da25ed3 View commit details
    Browse the repository at this point in the history

  5. Credit myself in the Changelog entry

    @vstinner
    vstinner committed Dec 5, 2023
    Configuration menu
    Copy the full SHA
    2b199bb View commit details
    Browse the repository at this point in the history

  6. Add email.utils.supports_strict_parsing attribute

    @vstinner
    vstinner committed Dec 5, 2023
    Configuration menu
    Copy the full SHA
    9b95376 View commit details
    Browse the repository at this point in the history

  7. Simplify getaddresses()

    @vstinner
    vstinner committed Dec 5, 2023
    Configuration menu
    Copy the full SHA
    cf50482 View commit details
    Browse the repository at this point in the history

  8. Update parseaddr() prototype in the doc

    @vstinner
    vstinner committed Dec 5, 2023
    Configuration menu
    Copy the full SHA
    0dd5745 View commit details
    Browse the repository at this point in the history

  9. Apply theta682's suggestion

    @vstinner
    vstinner committed Dec 5, 2023
    Configuration menu
    Copy the full SHA
    637bdb8 View commit details
    Browse the repository at this point in the history

Commits on Dec 12, 2023

  1. Update Lib/test/test_email/test_email.py 

    Co-authored-by: Petr Viktorin <encukou@gmail.com>
    @vstinner @encukou
    vstinner and encukou authored Dec 12, 2023
    Configuration menu
    Copy the full SHA
    8df7013 View commit details
    Browse the repository at this point in the history

  2. Restore removed test_getaddresses_comma_in_name()

    @vstinner
    vstinner committed Dec 12, 2023
    Configuration menu
    Copy the full SHA
    59da8f1 View commit details
    Browse the repository at this point in the history

  3. Move implementation details to comment

    @vstinner
    vstinner committed Dec 12, 2023
    Configuration menu
    Copy the full SHA
    361b517 View commit details
    Browse the repository at this point in the history

  4. Simplify _strip_quoted_realnames()

    @vstinner
    vstinner committed Dec 12, 2023
    Configuration menu
    Copy the full SHA
    3105a75 View commit details
    Browse the repository at this point in the history

Commits on Dec 13, 2023

  1. Fix _strip_quoted_realnames()

    @vstinner
    vstinner committed Dec 13, 2023
    Configuration menu
    Copy the full SHA
    fc6e86b View commit details
    Browse the repository at this point in the history