Skip to content

gh-91400: make sure email parsing dont unquote realnames with spaces - #92638

Open
carlbordum wants to merge 6 commits into
python:mainfrom
carlbordum:91400-formataddr
Open

gh-91400: make sure email parsing dont unquote realnames with spaces#92638
carlbordum wants to merge 6 commits into
python:mainfrom
carlbordum:91400-formataddr

Conversation

@carlbordum

@carlbordumcarlbordum commented May 10, 2022•
edited by gpshead
Loading

Copy link
Copy Markdown
Contributor

"Quote the name" portion of an email address in email.utils.formataddr() when it contains any spaces.

@carlbordum
carlbordum requested a review from a team as a code ownerMay 10, 2022 19:49
Akuli
Akuli reviewed May 12, 2022
View reviewed changes
Comment threadLib/test/test_email/test_email.py Outdated
@gpshead
Restrict NEWS wording to the exact behavior change.
7aa20b8
This way it describes the observable behavior change. Rather than the more broad wording that'd make a guarantee we don't actually test exhaustively for.
@bedevere-botbedevere-bot mentioned this pull request Mar 17, 2023
Open
@gpshead
simplify the test
5723107
running it a second time when a round tripped identical value has already been guaranteed doesn't do anything. Though it was meaningful during the original bug report, in correct code it is not.
@gpshead
Add a comment describing the purpose of the regexes.
027aa0a
@gpsheadgpshead self-assigned this Mar 17, 2023
@gpsheadgpshead added type-bug An unexpected behavior, bug, or error stdlib Standard Library Python modules in the Lib/ directory topic-email needs backport to 3.11 only security fixes needs backport to 3.10 only security fixes labels Mar 17, 2023
@gpshead

gpshead commented Mar 17, 2023

Copy link
Copy Markdown
Member

any objections from folks on email-team?

there is a caveat to this bug fix: anyone who had been working around it by doing their own test for characters and adding ""s when it wouldn't already be quoted by our existing code will now wind up with extra properly escaped " characters within their result.

that doesn't seem like a bad problem though, it is a valid address. Attempting to detect and handle that as a special case would be messy logic and lead to potentially worse outcomes of intended ""s that should be escaped not being preserved.

@arhadthedev

arhadthedev commented Apr 1, 2023

Copy link
Copy Markdown
Member

ping @python/email-team

@hugovkhugovk removed the needs backport to 3.10 only security fixes label Apr 8, 2023
@serhiy-storchakaserhiy-storchaka added needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes and removed needs backport to 3.11 only security fixes labels May 9, 2024
hugovk
hugovk approved these changes Mar 6, 2025
View reviewed changes

@hugovkhugovk left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

any objections from folks on email-team?

~Two years later and no objections, let's merge this.

@bitdancer

bitdancer commented Mar 6, 2025

Copy link
Copy Markdown
Member

Thanks for working on this, but see my analysis on the issue. The problem isn't with formataddr, which does the right thing, it's with parseaddr.

bitdancer
bitdancer requested changes Mar 6, 2025
View reviewed changes

@bitdancerbitdancer left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

formataddr does the right thing. It's parseaddr that would need a fix, as well as _headervalueparser.

@bedevere-app

bedevere-appBot commented Mar 6, 2025

Copy link
Copy Markdown

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

@hugovkhugovk removed the needs backport to 3.12 only security fixes label Apr 26, 2025
@serhiy-storchakaserhiy-storchaka added the needs backport to 3.14 bugs and security fixes label May 8, 2025
@github-actions

github-actionsBot commented Apr 11, 2026

Copy link
Copy Markdown

This PR is stale because it has been open for 30 days with no activity.

@github-actionsgithub-actionsBot added the stale Stale PR or inactive for long period of time. label Apr 11, 2026
@serhiy-storchakaserhiy-storchaka added the needs backport to 3.15 pre-release feature fixes, bugs and security fixes label May 30, 2026
@github-actionsgithub-actionsBot removed the stale Stale PR or inactive for long period of time. label Jun 5, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bitdancerbitdancerbitdancer requested changes
@gpsheadgpsheadgpshead approved these changes
@hugovkhugovkhugovk approved these changes
+1 more reviewer
@AkuliAkuliAkuli left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

@gpsheadgpshead

Labels

awaiting changesneeds backport to 3.13bugs and security fixesneeds backport to 3.14bugs and security fixesneeds backport to 3.15pre-release feature fixes, bugs and security fixesstdlibStandard Library Python modules in the Lib/ directorytopic-emailtype-bugAn unexpected behavior, bug, or error

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

8 participants

@carlbordum@gpshead@arhadthedev@bitdancer@hugovk@Akuli@serhiy-storchaka@bedevere-bot