Skip to content

[3.8] bpo-34155: Dont parse domains containing @ (GH-13079) - #14824

Merged
miss-islington merged 1 commit into
python:3.8from
miss-islington:backport-8cb65d1-3.8
Aug 9, 2019
Merged

[3.8] bpo-34155: Dont parse domains containing @ (GH-13079)#14824
miss-islington merged 1 commit into
python:3.8from
miss-islington:backport-8cb65d1-3.8

Conversation

@miss-islington

@miss-islingtonmiss-islington commented Jul 17, 2019

Copy link
Copy Markdown
Contributor

Before:

 >>> email.message_from_string('From: a@malicious.org@important.com', policy=email.policy.default)['from'].addresses
(Address(display_name='', username='a', domain='malicious.org'),)
>>> parseaddr('a@malicious.org@important.com')
('', 'a@malicious.org')
After:
>>> email.message_from_string('From: a@malicious.org@important.com', policy=email.policy.default)['from'].addresses
(Address(display_name='', username='', domain=''),)
>>> parseaddr('a@malicious.org@important.com')
('', 'a@')

https://bugs.python.org/issue34155
(cherry picked from commit 8cb65d1)

Co-authored-by: jpic jpic@users.noreply.github.com

https://bugs.python.org/issue34155

Before:
>>> email.message_from_string('From: a@malicious.org@important.com', policy=email.policy.default)['from'].addresses
(Address(display_name='', username='a', domain='malicious.org'),)
>>> parseaddr('a@malicious.org@important.com')
('', 'a@malicious.org')
After:
>>> email.message_from_string('From: a@malicious.org@important.com', policy=email.policy.default)['from'].addresses
(Address(display_name='', username='', domain=''),)
>>> parseaddr('a@malicious.org@important.com')
('', 'a@')
https://bugs.python.org/issue34155
(cherry picked from commit 8cb65d1)
Co-authored-by: jpic <jpic@users.noreply.github.com>
@miss-islington

Copy link
Copy Markdown
ContributorAuthor

@jpic: Status check is done, and it's a success ✅ .

2 similar comments
@miss-islington

Copy link
Copy Markdown
ContributorAuthor

@jpic: Status check is done, and it's a success ✅ .

@miss-islington

Copy link
Copy Markdown
ContributorAuthor

@jpic: Status check is done, and it's a success ✅ .

@maxkingmaxking left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@miss-islington
miss-islington merged commit 2170774 into python:3.8Aug 9, 2019
@miss-islington
miss-islington deleted the backport-8cb65d1-3.8 branch August 9, 2019 08:31
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

type-securityA security issue

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants

@miss-islington@maxking@the-knights-who-say-ni@bedevere-bot@jpic