Skip to content

[3.12] gh-143935: Email preserve parens when folding comments (GH-143936) - #144036

Merged
pablogsal merged 2 commits into
python:3.12from
miss-islington:backport-17d1490-3.12
Jan 26, 2026
Merged

[3.12] gh-143935: Email preserve parens when folding comments (GH-143936)#144036
pablogsal merged 2 commits into
python:3.12from
miss-islington:backport-17d1490-3.12

Conversation

@miss-islington

@miss-islingtonmiss-islington commented Jan 19, 2026

Copy link
Copy Markdown
Contributor

Fix a bug in the folding of comments when flattening an email message
using a modern email policy. Comments consisting of a very long sequence of
non-foldable characters could trigger a forced line wrap that omitted the
required leading space on the continuation line, causing the remainder of
the comment to be interpreted as a new header field. This enabled header
injection with carefully crafted inputs.
(cherry picked from commit 17d1490)

Co-authored-by: Seth Michael Larson seth@python.org
Co-authored-by: Denis Ledoux dle@odoo.com

…H-143936)
Fix a bug in the folding of comments when flattening an email message
using a modern email policy. Comments consisting of a very long sequence of
non-foldable characters could trigger a forced line wrap that omitted the
required leading space on the continuation line, causing the remainder of
the comment to be interpreted as a new header field. This enabled header
injection with carefully crafted inputs.
(cherry picked from commit 17d1490)
Co-authored-by: Seth Michael Larson <seth@python.org>
Co-authored-by: Denis Ledoux <dle@odoo.com>

@pablogsalpablogsal left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@pablogsal
pablogsal enabled auto-merge (squash) January 25, 2026 17:11
@pablogsal
pablogsal merged commit a76e4cd into python:3.12Jan 26, 2026
47 of 49 checks passed
@miss-islington
miss-islington deleted the backport-17d1490-3.12 branch January 26, 2026 17:16
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

topic-emailtype-securityA security issue

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@miss-islington@pablogsal@sethmlarson