bpo-13940: imaplib: All string arguments are now quoted when necessary.

Lib/imaplib.py

@@ -110,7 +110,7 @@
  br'"')
 # Literal is no longer used; kept for backward compatibility.
 Literal = re.compile(br'.*{(?P<size>\d+)}$', re.ASCII)
-MapCRLF = re.compile(br'\r\n|\r|\n')
+MapCRLF = re.compile(br'[\r\n]')
 # We no longer exclude the ']' character from the data portion of the response
 # code, even though it violates the RFC. Popular IMAP servers such as Gmail
 # allow flags with ']', and there are programs (including imaplib!) that can
@@ -128,6 +128,8 @@
 _Literal = br'.*{(?P<size>\d+)}$'
 _Untagged_status = br'\* (?P<data>\d+) (?P<type>[A-Z-]+)( (?P<data2>.*))?'
 
+_Atom_Specials = re.compile(r'[\x00-\x1F\(\)\{ %\*"\\\]]')
+_Quoted_Invalid = re.compile(r'[\r\n]')
 
 
 class IMAP4:
@@ -144,13 +146,10 @@ class IMAP4:
 
  All arguments to commands are converted to strings, except for
  AUTHENTICATE, and the last argument to APPEND which is passed as
- an IMAP4 literal. If necessary (the string contains any
- non-printing characters or white-space and isn't enclosed with
- either parentheses or double quotes) each string is quoted.
- However, the 'password' argument to the LOGIN command is always
- quoted. If you want to avoid having an argument string quoted
- (eg: the 'flags' argument to STORE) then enclose the string in
- parentheses (eg: "(\Deleted)").
+ an IMAP4 literal. If necessary, each string is quoted. If you
+ want to avoid having an argument string quoted (eg: the 'flags'
+ argument to STORE) then enclose the string in parentheses
+ (eg: "(\Deleted)").
 
  Each command returns a tuple: (type, [data, ...]) where 'type'
  is usually 'OK' or 'NO', and 'data' is either the text from the
@@ -585,10 +584,8 @@ def login(self, user, password):
  """Identify client using plaintext password.
 
  (typ, [data]) = <instance>.login(user, password)
-
- NB: 'password' will be quoted.
  """
- typ, dat = self._simple_command('LOGIN', user, self._quote(password))
+ typ, dat = self._simple_command('LOGIN', user, password)
  if typ != 'OK':
  raise self.error(dat[-1])
  self.state = 'AUTH'
@@ -952,6 +949,12 @@ def _command(self, name, *args):
  for arg in args:
  if arg is None: continue
  if isinstance(arg, str):
+ if _Quoted_Invalid.search(arg):
+ raise self.error('illegal cr or lf in argument')
+ if len(arg) > 2 and [arg[0], arg[-1]] == ['(', ')']:
+ arg = arg[1:-1]
+ elif _Atom_Specials.search(arg):
+ arg = self._quote(arg)
  arg = bytes(arg, self._encoding)
  data = data + b' ' + arg
 

Lib/test/test_imaplib.py

@@ -242,6 +242,52 @@ def cmd_CAPABILITY(self, tag, args):
  self.assertRaises(imaplib.IMAP4.abort, self.imap_class,
  *server.server_address)
 
+ def test_create_quoted(self):
+ # https://bugs.python.org/issue13940
+ class CreateHandler(SimpleIMAPHandler):
+ def cmd_CREATE(self, tag, args):
+ if ' '.join(args) == '"quoted name with spaces and escaped \\" \\\\ specials"':
+ self._send_tagged(tag, 'OK', 'CREATE completed')
+ return self._send_tagged(tag, 'BAD', args[0])
+ client, server = self._setup(CreateHandler)
+ client.state = 'AUTH'
+ typ, data = client.create('quoted name with spaces and escaped " \\ specials')
+ self.assertEqual(typ, 'OK')
+ self.assertEqual(data[0], b'CREATE completed')
+
+ def test_create_unquoted(self):
+ # https://bugs.python.org/issue13940
+ class CreateHandler(SimpleIMAPHandler):
+ def cmd_CREATE(self, tag, args):
+ if args[0] == 'unquoted-name-with-no-sp3cials':
+ self._send_tagged(tag, 'OK', 'CREATE completed')
+ return self._send_tagged(tag, 'BAD', args[0])
+ client, server = self._setup(CreateHandler)
+ client.state = 'AUTH'
+ typ, data = client.create('unquoted-name-with-no-sp3cials')
+ self.assertEqual(typ, 'OK')
+ self.assertEqual(data[0], b'CREATE completed')
+
+ def test_create_force_unquoted(self):
+ # https://bugs.python.org/issue13940
+ class CreateHandler(SimpleIMAPHandler):
+ def cmd_CREATE(self, tag, args):
+ if ' '.join(args) == 'unquoted name with spaces and " \\ specials':
+ self._send_tagged(tag, 'OK', 'CREATE completed')
+ return self._send_tagged(tag, 'BAD', args[0])
+ client, server = self._setup(CreateHandler)
+ client.state = 'AUTH'
+ typ, data = client.create('(unquoted name with spaces and " \\ specials)')
+ self.assertEqual(typ, 'OK')
+ self.assertEqual(data[0], b'CREATE completed')
+
+ def test_create_crlf(self):
+ client, server = self._setup(SimpleIMAPHandler)
+ client.state = 'AUTH'
+ with self.assertRaisesRegex(imaplib.IMAP4.error,
+ 'illegal cr or lf in argument'):
+ typ, data = client.create('name with CR and LF \n\r')
+
  def test_enable_raises_error_if_not_AUTH(self):
  class EnableHandler(SimpleIMAPHandler):
  capabilities = 'AUTH ENABLE UTF8=ACCEPT'