|
| 1 | +From 93144627af290c12f4aee722687ad27dc858cf96 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Sreenivasulu Malavathula <v-smalavathu@microsoft.com> |
| 3 | +Date: Thu, 6 Mar 2025 20:18:02 -0600 |
| 4 | +Subject: [PATCH] Address CVE-2025-1795 |
| 5 | + |
| 6 | +--- |
| 7 | + Lib/email/_header_value_parser.py | 3 ++- |
| 8 | + Lib/test/test_email/test__header_value_parser.py | 5 +++++ |
| 9 | + 2 files changed, 7 insertions(+), 1 deletion(-) |
| 10 | + |
| 11 | +diff --git a/Lib/email/_header_value_parser.py b/Lib/email/_header_value_parser.py |
| 12 | +index e394cfd..8a0295a 100644 |
| 13 | +--- a/Lib/email/_header_value_parser.py |
| 14 | ++++ b/Lib/email/_header_value_parser.py |
| 15 | +@@ -951,6 +951,7 @@ class _InvalidEwError(errors.HeaderParseError): |
| 16 | + # up other parse trees. Maybe should have tests for that, too. |
| 17 | + DOT = ValueTerminal('.', 'dot') |
| 18 | + ListSeparator = ValueTerminal(',', 'list-separator') |
| 19 | ++ListSeparator.as_ew_allowed = False |
| 20 | + RouteComponentMarker = ValueTerminal('@', 'route-component-marker') |
| 21 | + |
| 22 | + # |
| 23 | +@@ -2024,7 +2025,7 @@ def get_address_list(value): |
| 24 | + address_list.defects.append(errors.InvalidHeaderDefect( |
| 25 | + "invalid address in address-list")) |
| 26 | + if value: # Must be a , at this point. |
| 27 | +- address_list.append(ValueTerminal(',', 'list-separator')) |
| 28 | ++ address_list.append(ListSeparator) |
| 29 | + value = value[1:] |
| 30 | + return address_list, value |
| 31 | + |
| 32 | +diff --git a/Lib/test/test_email/test__header_value_parser.py b/Lib/test/test_email/test__header_value_parser.py |
| 33 | +index 854f2ff..7063ce7 100644 |
| 34 | +--- a/Lib/test/test_email/test__header_value_parser.py |
| 35 | ++++ b/Lib/test/test_email/test__header_value_parser.py |
| 36 | +@@ -2946,6 +2946,11 @@ class TestFolding(TestEmailBase): |
| 37 | + '=?utf-8?q?H=C3=BCbsch?= Kaktus <beautiful@example.com>,\n' |
| 38 | + ' =?utf-8?q?bei=C3=9Ft_bei=C3=9Ft?= <biter@example.com>\n') |
| 39 | + |
| 40 | ++ def test_address_list_with_list_separator_after_fold(self): |
| 41 | ++ to = '0123456789' * 8 + '@foo, ä <foo@bar>' |
| 42 | ++ self._test(parser.get_address_list(to)[0], |
| 43 | ++ '0123456789' * 8 + '@foo,\n =?utf-8?q?=C3=A4?= <foo@bar>\n') |
| 44 | ++ |
| 45 | + # XXX Need tests with comments on various sides of a unicode token, |
| 46 | + # and with unicode tokens in the comments. Spaces inside the quotes |
| 47 | + # currently don't do the right thing. |
| 48 | +-- |
| 49 | +2.45.2 |
| 50 | + |
0 commit comments