Browse Source
python3: bump to version 3.8
This required a bit work to get working, compared to other versions. So,
some things have changed a bit more significantly.
Some highlights:
* there is no longer a pgen executable, seems this is now part of
libpython; let's see what this means for us in the future
* blake2 hash (from OpenSSL) detection needs some fixing; will upstream
added patch 002-fix-blake2-detection.patch
* removed all bpo patches; those should be fixed in upstream
* some needed to be manually re-applied as stuff changed:
- 001-enable-zlib.patch - file changed
- 004-do-not-write-bytes-codes.patch - file changed
- 015-abort-on-failed-modules.patch - variable was renamed
cross_compiling -> CROSS_COMPILING
* 017_lib2to3_fix_pyc_search.patch - the code changed, it does not seem to
have the original problem with respect to file-extension, as there
does not seem to be any special extension logic anymore there
* 006-remove-multi-arch-and-local-paths.patch - dropped patch; I can't
remember the full-details of this issue; it was something with
Debian/Ubuntu's multi-arch stuff; it was probably added maybe due to
some overzealous (on my part) thingy caused by some weird reports,
that I could never solve; let's have this patch dropped and see
* make package/python3/refresh to reduce fuzz for the rest
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
lilik-openwrt-22.03
Alexandru Ardelean
5 years ago
18 changed files with 46 additions and 507 deletions
Split View
Diff Options
-
+4 -4lang/python/python3-version.mk
-
+4 -7lang/python/python3/Makefile
-
+3 -12lang/python/python3/patches/001-enable-zlib.patch
-
+11 -0lang/python/python3/patches/002-fix-blake2-detection.patch
-
+4 -4lang/python/python3/patches/003-do-not-run-distutils-tests.patch
-
+2 -2lang/python/python3/patches/004-do-not-write-bytes-codes.patch
-
+0 -19lang/python/python3/patches/006-remove-multi-arch-and-local-paths.patch
-
+2 -2lang/python/python3/patches/008-distutils-use-python-sysroot.patch
-
+2 -2lang/python/python3/patches/010-do-not-add-rt-lib-dirs-when-cross-compiling.patch
-
+3 -3lang/python/python3/patches/013-getbuildinfo-date-time-source-date-epoch.patch
-
+3 -3lang/python/python3/patches/014-remove-platform-so-suffix.patch
-
+2 -2lang/python/python3/patches/015-abort-on-failed-modules.patch
-
+6 -6lang/python/python3/patches/016-adjust-config-paths.patch
-
+0 -15lang/python/python3/patches/017_lib2to3_fix_pyc_search.patch
-
+0 -56lang/python/python3/patches/025-bpo-37461-Fix-infinite-loop-in-parsing-of-specially-.patch
-
+0 -167lang/python/python3/patches/026-3.7-bpo-37764-Fix-infinite-loop-when-parsing-unstruc.patch
-
+0 -74lang/python/python3/patches/027-bpo-38243-xmlrpc.server-Escape-the-server_title-GH-1.patch
-
+0 -129lang/python/python3/patches/028-bpo-34155-Dont-parse-domains-containing-GH-13079.patch
+ 4
- 4
lang/python/python3-version.mk
View File
+ 4
- 7
lang/python/python3/Makefile
View File
+ 3
- 12
lang/python/python3/patches/001-enable-zlib.patch
View File
+ 11
- 0
lang/python/python3/patches/002-fix-blake2-detection.patch
View File
| @ -0,0 +1,11 @@ | |||
| --- a/Modules/_hashopenssl.c | |||
| +++ b/Modules/_hashopenssl.c | |||
| @@ -42,7 +42,7 @@ | |||
| #define PY_OPENSSL_HAS_SHAKE 1 | |||
| #endif | |||
| -#ifdef NID_blake2b512 | |||
| +#ifndef OPENSSL_NO_BLAKE2 | |||
| #define PY_OPENSSL_HAS_BLAKE2 1 | |||
| #endif | |||
+ 4
- 4
lang/python/python3/patches/003-do-not-run-distutils-tests.patch
View File
+ 2
- 2
lang/python/python3/patches/004-do-not-write-bytes-codes.patch
View File
+ 0
- 19
lang/python/python3/patches/006-remove-multi-arch-and-local-paths.patch
View File
| @ -1,19 +0,0 @@ | |||
| --- a/setup.py | |||
| +++ b/setup.py | |||
| @@ -581,16 +581,9 @@ class PyBuildExt(build_ext): | |||
| os.unlink(tmpfile) | |||
| def detect_modules(self): | |||
| - # Ensure that /usr/local is always used, but the local build | |||
| - # directories (i.e. '.' and 'Include') must be first. See issue | |||
| - # 10520. | |||
| - if not cross_compiling: | |||
| - add_dir_to_list(self.compiler.library_dirs, '/usr/local/lib') | |||
| - add_dir_to_list(self.compiler.include_dirs, '/usr/local/include') | |||
| # only change this for cross builds for 3.3, issues on Mageia | |||
| if cross_compiling: | |||
| self.add_gcc_paths() | |||
| - self.add_multiarch_paths() | |||
| # Add paths specified in the environment variables LDFLAGS and | |||
| # CPPFLAGS for header and library files. | |||
+ 2
- 2
lang/python/python3/patches/008-distutils-use-python-sysroot.patch
View File
+ 2
- 2
lang/python/python3/patches/010-do-not-add-rt-lib-dirs-when-cross-compiling.patch
View File
+ 3
- 3
lang/python/python3/patches/013-getbuildinfo-date-time-source-date-epoch.patch
View File
+ 3
- 3
lang/python/python3/patches/014-remove-platform-so-suffix.patch
View File
+ 2
- 2
lang/python/python3/patches/015-abort-on-failed-modules.patch
View File
| @ -1,10 +1,10 @@ | |||
| --- a/setup.py | |||
| +++ b/setup.py | |||
| @@ -398,6 +398,7 @@ class PyBuildExt(build_ext): | |||
| @@ -441,6 +441,7 @@ class PyBuildExt(build_ext): | |||
| print("Failed to build these modules:") | |||
| print_three_column(failed) | |||
| print() | |||
| + if cross_compiling: sys.exit(1) | |||
| + if CROSS_COMPILING: sys.exit(1) | |||
| if self.failed_on_import: | |||
| failed = self.failed_on_import[:] | |||
+ 6
- 6
lang/python/python3/patches/016-adjust-config-paths.patch
View File
+ 0
- 15
lang/python/python3/patches/017_lib2to3_fix_pyc_search.patch
View File
| @ -1,15 +0,0 @@ | |||
| --- a/Lib/lib2to3/refactor.py | |||
| +++ b/Lib/lib2to3/refactor.py | |||
| @@ -37,6 +37,12 @@ def get_all_fix_names(fixer_pkg, remove_ | |||
| if remove_prefix: | |||
| name = name[4:] | |||
| fix_names.append(name[:-3]) | |||
| + if name.startswith("fix_") and name.endswith(".pyc"): | |||
| + if remove_prefix: | |||
| + name = name[4:] | |||
| + name = name[:-4] | |||
| + if name not in fix_names: | |||
| + fix_names.append(name) | |||
| return fix_names | |||
+ 0
- 56
lang/python/python3/patches/025-bpo-37461-Fix-infinite-loop-in-parsing-of-specially-.patch
View File
| @ -1,56 +0,0 @@ | |||
| From 391511ccaaf0050970dfbe95bf2df1bcf6c33440 Mon Sep 17 00:00:00 2001 | |||
| From: "Miss Islington (bot)" | |||
| <31488909+miss-islington@users.noreply.github.com> | |||
| Date: Wed, 17 Jul 2019 10:02:05 -0700 | |||
| Subject: [PATCH] bpo-37461: Fix infinite loop in parsing of specially crafted | |||
| email headers (GH-14794) | |||
| * bpo-37461: Fix infinite loop in parsing of specially crafted email headers. | |||
| Some crafted email header would cause the get_parameter method to run in an | |||
| infinite loop causing a DoS attack surface when parsing those headers. This | |||
| patch fixes that by making sure the DQUOTE character is handled to prevent | |||
| going into an infinite loop. | |||
| (cherry picked from commit a4a994bd3e619cbaff97610a1cee8ffa87c672f5) | |||
| Co-authored-by: Abhilash Raj <maxking@users.noreply.github.com> | |||
| --- | |||
| Lib/email/_header_value_parser.py | 3 +++ | |||
| Lib/test/test_email/test__header_value_parser.py | 7 +++++++ | |||
| .../next/Security/2019-07-16-08-11-00.bpo-37461.1Ahz7O.rst | 2 ++ | |||
| 3 files changed, 12 insertions(+) | |||
| create mode 100644 Misc/NEWS.d/next/Security/2019-07-16-08-11-00.bpo-37461.1Ahz7O.rst | |||
| --- a/Lib/email/_header_value_parser.py | |||
| +++ b/Lib/email/_header_value_parser.py | |||
| @@ -2387,6 +2387,9 @@ def get_parameter(value): | |||
| while value: | |||
| if value[0] in WSP: | |||
| token, value = get_fws(value) | |||
| + elif value[0] == '"': | |||
| + token = ValueTerminal('"', 'DQUOTE') | |||
| + value = value[1:] | |||
| else: | |||
| token, value = get_qcontent(value) | |||
| v.append(token) | |||
| --- a/Lib/test/test_email/test__header_value_parser.py | |||
| +++ b/Lib/test/test_email/test__header_value_parser.py | |||
| @@ -2621,6 +2621,13 @@ class Test_parse_mime_parameters(TestPar | |||
| # Defects are apparent missing *0*, and two 'out of sequence'. | |||
| [errors.InvalidHeaderDefect]*3), | |||
| + # bpo-37461: Check that we don't go into an infinite loop. | |||
| + 'extra_dquote': ( | |||
| + 'r*="\'a\'\\"', | |||
| + ' r="\\""', | |||
| + 'r*=\'a\'"', | |||
| + [('r', '"')], | |||
| + [errors.InvalidHeaderDefect]*2), | |||
| } | |||
| @parameterize | |||
| --- /dev/null | |||
| +++ b/Misc/NEWS.d/next/Security/2019-07-16-08-11-00.bpo-37461.1Ahz7O.rst | |||
| @@ -0,0 +1,2 @@ | |||
| +Fix an inifite loop when parsing specially crafted email headers. Patch by | |||
| +Abhilash Raj. | |||
+ 0
- 167
lang/python/python3/patches/026-3.7-bpo-37764-Fix-infinite-loop-when-parsing-unstruc.patch
View File
| @ -1,167 +0,0 @@ | |||
| From ea21389dda401457198fb214aa2c981a45ed9528 Mon Sep 17 00:00:00 2001 | |||
| From: Ashwin Ramaswami <aramaswamis@gmail.com> | |||
| Date: Tue, 3 Sep 2019 09:42:53 -0700 | |||
| Subject: [PATCH] [3.7] bpo-37764: Fix infinite loop when parsing unstructured | |||
| email headers. (GH-15239) (GH-15654) | |||
| MIME-Version: 1.0 | |||
| Content-Type: text/plain; charset=UTF-8 | |||
| Content-Transfer-Encoding: 8bit | |||
| …aders. (GH-15239) | |||
| Fixes a case in which email._header_value_parser.get_unstructured hangs the system for some invalid headers. This covers the cases in which the header contains either: | |||
| - a case without trailing whitespace | |||
| - an invalid encoded word | |||
| https://bugs.python.org/issue37764 | |||
| This fix should also be backported to 3.7 and 3.8 | |||
| https://bugs.python.org/issue37764 | |||
| (cherry picked from commit c5b242f87f31286ad38991bc3868cf4cfbf2b681) | |||
| Co-authored-by: Ashwin Ramaswami <aramaswamis@gmail.com> | |||
| https://bugs.python.org/issue37764 | |||
| --- | |||
| Lib/email/_header_value_parser.py | 19 ++++++++++++++--- | |||
| .../test_email/test__header_value_parser.py | 16 ++++++++++++++ | |||
| Lib/test/test_email/test_email.py | 21 +++++++++++++++++++ | |||
| Misc/ACKS | 1 + | |||
| .../2019-08-27-01-13-05.bpo-37764.qv67PQ.rst | 1 + | |||
| 5 files changed, 55 insertions(+), 3 deletions(-) | |||
| create mode 100644 Misc/NEWS.d/next/Security/2019-08-27-01-13-05.bpo-37764.qv67PQ.rst | |||
| --- a/Lib/email/_header_value_parser.py | |||
| +++ b/Lib/email/_header_value_parser.py | |||
| @@ -931,6 +931,10 @@ class EWWhiteSpaceTerminal(WhiteSpaceTer | |||
| return '' | |||
| +class _InvalidEwError(errors.HeaderParseError): | |||
| + """Invalid encoded word found while parsing headers.""" | |||
| + | |||
| + | |||
| # XXX these need to become classes and used as instances so | |||
| # that a program can't change them in a parse tree and screw | |||
| # up other parse trees. Maybe should have tests for that, too. | |||
| @@ -1035,7 +1039,10 @@ def get_encoded_word(value): | |||
| raise errors.HeaderParseError( | |||
| "expected encoded word but found {}".format(value)) | |||
| remstr = ''.join(remainder) | |||
| - if len(remstr) > 1 and remstr[0] in hexdigits and remstr[1] in hexdigits: | |||
| + if (len(remstr) > 1 and | |||
| + remstr[0] in hexdigits and | |||
| + remstr[1] in hexdigits and | |||
| + tok.count('?') < 2): | |||
| # The ? after the CTE was followed by an encoded word escape (=XX). | |||
| rest, *remainder = remstr.split('?=', 1) | |||
| tok = tok + '?=' + rest | |||
| @@ -1047,7 +1054,7 @@ def get_encoded_word(value): | |||
| try: | |||
| text, charset, lang, defects = _ew.decode('=?' + tok + '?=') | |||
| except ValueError: | |||
| - raise errors.HeaderParseError( | |||
| + raise _InvalidEwError( | |||
| "encoded word format invalid: '{}'".format(ew.cte)) | |||
| ew.charset = charset | |||
| ew.lang = lang | |||
| @@ -1097,9 +1104,12 @@ def get_unstructured(value): | |||
| token, value = get_fws(value) | |||
| unstructured.append(token) | |||
| continue | |||
| + valid_ew = True | |||
| if value.startswith('=?'): | |||
| try: | |||
| token, value = get_encoded_word(value) | |||
| + except _InvalidEwError: | |||
| + valid_ew = False | |||
| except errors.HeaderParseError: | |||
| # XXX: Need to figure out how to register defects when | |||
| # appropriate here. | |||
| @@ -1121,7 +1131,10 @@ def get_unstructured(value): | |||
| # Split in the middle of an atom if there is a rfc2047 encoded word | |||
| # which does not have WSP on both sides. The defect will be registered | |||
| # the next time through the loop. | |||
| - if rfc2047_matcher.search(tok): | |||
| + # This needs to only be performed when the encoded word is valid; | |||
| + # otherwise, performing it on an invalid encoded word can cause | |||
| + # the parser to go in an infinite loop. | |||
| + if valid_ew and rfc2047_matcher.search(tok): | |||
| tok, *remainder = value.partition('=?') | |||
| vtext = ValueTerminal(tok, 'vtext') | |||
| _validate_xtext(vtext) | |||
| --- a/Lib/test/test_email/test__header_value_parser.py | |||
| +++ b/Lib/test/test_email/test__header_value_parser.py | |||
| @@ -383,6 +383,22 @@ class TestParser(TestParserMixin, TestEm | |||
| [errors.InvalidHeaderDefect], | |||
| '') | |||
| + def test_get_unstructured_without_trailing_whitespace_hang_case(self): | |||
| + self._test_get_x(self._get_unst, | |||
| + '=?utf-8?q?somevalue?=aa', | |||
| + 'somevalueaa', | |||
| + 'somevalueaa', | |||
| + [errors.InvalidHeaderDefect], | |||
| + '') | |||
| + | |||
| + def test_get_unstructured_invalid_ew(self): | |||
| + self._test_get_x(self._get_unst, | |||
| + '=?utf-8?q?=somevalue?=', | |||
| + '=?utf-8?q?=somevalue?=', | |||
| + '=?utf-8?q?=somevalue?=', | |||
| + [], | |||
| + '') | |||
| + | |||
| # get_qp_ctext | |||
| def test_get_qp_ctext_only(self): | |||
| --- a/Lib/test/test_email/test_email.py | |||
| +++ b/Lib/test/test_email/test_email.py | |||
| @@ -5367,6 +5367,27 @@ Content-Type: application/x-foo; | |||
| eq(language, 'en-us') | |||
| eq(s, 'My Document For You') | |||
| + def test_should_not_hang_on_invalid_ew_messages(self): | |||
| + messages = ["""From: user@host.com | |||
| +To: user@host.com | |||
| +Bad-Header: | |||
| + =?us-ascii?Q?LCSwrV11+IB0rSbSker+M9vWR7wEDSuGqmHD89Gt=ea0nJFSaiz4vX3XMJPT4vrE?= | |||
| + =?us-ascii?Q?xGUZeOnp0o22pLBB7CYLH74Js=wOlK6Tfru2U47qR?= | |||
| + =?us-ascii?Q?72OfyEY2p2=2FrA9xNFyvH+fBTCmazxwzF8nGkK6D?= | |||
| + | |||
| +Hello! | |||
| +""", """From: ����� �������� <xxx@xxx> | |||
| +To: "xxx" <xxx@xxx> | |||
| +Subject: ��� ���������� ����� ����� � ��������� �� ���� | |||
| +MIME-Version: 1.0 | |||
| +Content-Type: text/plain; charset="windows-1251"; | |||
| +Content-Transfer-Encoding: 8bit | |||
| + | |||
| +�� ����� � ���� ������ ��� �������� | |||
| +"""] | |||
| + for m in messages: | |||
| + with self.subTest(m=m): | |||
| + msg = email.message_from_string(m) | |||
| # Tests to ensure that signed parts of an email are completely preserved, as | |||
| --- a/Misc/ACKS | |||
| +++ b/Misc/ACKS | |||
| @@ -1305,6 +1305,7 @@ Burton Radons | |||
| Abhilash Raj | |||
| Shorya Raj | |||
| Dhushyanth Ramasamy | |||
| +Ashwin Ramaswami | |||
| Jeff Ramnani | |||
| Bayard Randel | |||
| Varpu Rantala | |||
| --- /dev/null | |||
| +++ b/Misc/NEWS.d/next/Security/2019-08-27-01-13-05.bpo-37764.qv67PQ.rst | |||
| @@ -0,0 +1 @@ | |||
| +Fixes email._header_value_parser.get_unstructured going into an infinite loop for a specific case in which the email header does not have trailing whitespace, and the case in which it contains an invalid encoded word. Patch by Ashwin Ramaswami. | |||
| \ No newline at end of file | |||
+ 0
- 74
lang/python/python3/patches/027-bpo-38243-xmlrpc.server-Escape-the-server_title-GH-1.patch
View File
| @ -1,74 +0,0 @@ | |||
| From 39a0c7555530e31c6941a78da19b6a5b61170687 Mon Sep 17 00:00:00 2001 | |||
| From: "Miss Islington (bot)" | |||
| <31488909+miss-islington@users.noreply.github.com> | |||
| Date: Fri, 27 Sep 2019 13:18:14 -0700 | |||
| Subject: [PATCH] bpo-38243, xmlrpc.server: Escape the server_title (GH-16373) | |||
| Escape the server title of xmlrpc.server.DocXMLRPCServer | |||
| when rendering the document page as HTML. | |||
| (cherry picked from commit e8650a4f8c7fb76f570d4ca9c1fbe44e91c8dfaa) | |||
| Co-authored-by: Dong-hee Na <donghee.na92@gmail.com> | |||
| --- | |||
| Lib/test/test_docxmlrpc.py | 16 ++++++++++++++++ | |||
| Lib/xmlrpc/server.py | 3 ++- | |||
| .../2019-09-25-13-21-09.bpo-38243.1pfz24.rst | 3 +++ | |||
| 3 files changed, 21 insertions(+), 1 deletion(-) | |||
| create mode 100644 Misc/NEWS.d/next/Security/2019-09-25-13-21-09.bpo-38243.1pfz24.rst | |||
| --- a/Lib/test/test_docxmlrpc.py | |||
| +++ b/Lib/test/test_docxmlrpc.py | |||
| @@ -1,5 +1,6 @@ | |||
| from xmlrpc.server import DocXMLRPCServer | |||
| import http.client | |||
| +import re | |||
| import sys | |||
| import threading | |||
| from test import support | |||
| @@ -193,6 +194,21 @@ class DocXMLRPCHTTPGETServer(unittest.Te | |||
| b'method_annotation</strong></a>(x: bytes)</dt></dl>'), | |||
| response.read()) | |||
| + def test_server_title_escape(self): | |||
| + # bpo-38243: Ensure that the server title and documentation | |||
| + # are escaped for HTML. | |||
| + self.serv.set_server_title('test_title<script>') | |||
| + self.serv.set_server_documentation('test_documentation<script>') | |||
| + self.assertEqual('test_title<script>', self.serv.server_title) | |||
| + self.assertEqual('test_documentation<script>', | |||
| + self.serv.server_documentation) | |||
| + | |||
| + generated = self.serv.generate_html_documentation() | |||
| + title = re.search(r'<title>(.+?)</title>', generated).group() | |||
| + documentation = re.search(r'<p><tt>(.+?)</tt></p>', generated).group() | |||
| + self.assertEqual('<title>Python: test_title<script></title>', title) | |||
| + self.assertEqual('<p><tt>test_documentation<script></tt></p>', documentation) | |||
| + | |||
| if __name__ == '__main__': | |||
| unittest.main() | |||
| --- a/Lib/xmlrpc/server.py | |||
| +++ b/Lib/xmlrpc/server.py | |||
| @@ -108,6 +108,7 @@ from xmlrpc.client import Fault, dumps, | |||
| from http.server import BaseHTTPRequestHandler | |||
| from functools import partial | |||
| from inspect import signature | |||
| +import html | |||
| import http.server | |||
| import socketserver | |||
| import sys | |||
| @@ -894,7 +895,7 @@ class XMLRPCDocGenerator: | |||
| methods | |||
| ) | |||
| - return documenter.page(self.server_title, documentation) | |||
| + return documenter.page(html.escape(self.server_title), documentation) | |||
| class DocXMLRPCRequestHandler(SimpleXMLRPCRequestHandler): | |||
| """XML-RPC and documentation request handler class. | |||
| --- /dev/null | |||
| +++ b/Misc/NEWS.d/next/Security/2019-09-25-13-21-09.bpo-38243.1pfz24.rst | |||
| @@ -0,0 +1,3 @@ | |||
| +Escape the server title of :class:`xmlrpc.server.DocXMLRPCServer` | |||
| +when rendering the document page as HTML. | |||
| +(Contributed by Dong-hee Na in :issue:`38243`.) | |||
+ 0
- 129
lang/python/python3/patches/028-bpo-34155-Dont-parse-domains-containing-GH-13079.patch
View File
| @ -1,129 +0,0 @@ | |||
| From 77bb21f6e06aabc81d672dbdd6f8834c40544351 Mon Sep 17 00:00:00 2001 | |||
| From: jpic <jpic@users.noreply.github.com> | |||
| Date: Wed, 17 Jul 2019 23:54:25 +0200 | |||
| Subject: [PATCH] bpo-34155: Dont parse domains containing @ (GH-13079) | |||
| Before: | |||
| >>> email.message_from_string('From: a@malicious.org@important.com', policy=email.policy.default)['from'].addresses | |||
| (Address(display_name='', username='a', domain='malicious.org'),) | |||
| >>> parseaddr('a@malicious.org@important.com') | |||
| ('', 'a@malicious.org') | |||
| After: | |||
| >>> email.message_from_string('From: a@malicious.org@important.com', policy=email.policy.default)['from'].addresses | |||
| (Address(display_name='', username='', domain=''),) | |||
| >>> parseaddr('a@malicious.org@important.com') | |||
| ('', 'a@') | |||
| https://bugs.python.org/issue34155 | |||
| (cherry picked from commit 8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9) | |||
| Co-authored-by: jpic <jpic@users.noreply.github.com> | |||
| --- | |||
| Lib/email/_header_value_parser.py | 2 ++ | |||
| Lib/email/_parseaddr.py | 11 ++++++++++- | |||
| Lib/test/test_email/test__header_value_parser.py | 10 ++++++++++ | |||
| Lib/test/test_email/test_email.py | 14 ++++++++++++++ | |||
| .../2019-05-04-13-33-37.bpo-34155.MJll68.rst | 1 + | |||
| 5 files changed, 37 insertions(+), 1 deletion(-) | |||
| create mode 100644 Misc/NEWS.d/next/Security/2019-05-04-13-33-37.bpo-34155.MJll68.rst | |||
| diff --git a/Lib/email/_header_value_parser.py b/Lib/email/_header_value_parser.py | |||
| index 801ae728dd136..c09f4f121ffb6 100644 | |||
| --- a/Lib/email/_header_value_parser.py | |||
| +++ b/Lib/email/_header_value_parser.py | |||
| @@ -1585,6 +1585,8 @@ def get_domain(value): | |||
| token, value = get_dot_atom(value) | |||
| except errors.HeaderParseError: | |||
| token, value = get_atom(value) | |||
| + if value and value[0] == '@': | |||
| + raise errors.HeaderParseError('Invalid Domain') | |||
| if leader is not None: | |||
| token[:0] = [leader] | |||
| domain.append(token) | |||
| diff --git a/Lib/email/_parseaddr.py b/Lib/email/_parseaddr.py | |||
| index cdfa3729adc79..41ff6f8c000d5 100644 | |||
| --- a/Lib/email/_parseaddr.py | |||
| +++ b/Lib/email/_parseaddr.py | |||
| @@ -379,7 +379,12 @@ def getaddrspec(self): | |||
| aslist.append('@') | |||
| self.pos += 1 | |||
| self.gotonext() | |||
| - return EMPTYSTRING.join(aslist) + self.getdomain() | |||
| + domain = self.getdomain() | |||
| + if not domain: | |||
| + # Invalid domain, return an empty address instead of returning a | |||
| + # local part to denote failed parsing. | |||
| + return EMPTYSTRING | |||
| + return EMPTYSTRING.join(aslist) + domain | |||
| def getdomain(self): | |||
| """Get the complete domain name from an address.""" | |||
| @@ -394,6 +399,10 @@ def getdomain(self): | |||
| elif self.field[self.pos] == '.': | |||
| self.pos += 1 | |||
| sdlist.append('.') | |||
| + elif self.field[self.pos] == '@': | |||
| + # bpo-34155: Don't parse domains with two `@` like | |||
| + # `a@malicious.org@important.com`. | |||
| + return EMPTYSTRING | |||
| elif self.field[self.pos] in self.atomends: | |||
| break | |||
| else: | |||
| diff --git a/Lib/test/test_email/test__header_value_parser.py b/Lib/test/test_email/test__header_value_parser.py | |||
| index 9e862feab10c9..0f19f8bcc2e0f 100644 | |||
| --- a/Lib/test/test_email/test__header_value_parser.py | |||
| +++ b/Lib/test/test_email/test__header_value_parser.py | |||
| @@ -1448,6 +1448,16 @@ def test_get_addr_spec_dot_atom(self): | |||
| self.assertEqual(addr_spec.domain, 'example.com') | |||
| self.assertEqual(addr_spec.addr_spec, 'star.a.star@example.com') | |||
| + def test_get_addr_spec_multiple_domains(self): | |||
| + with self.assertRaises(errors.HeaderParseError): | |||
| + parser.get_addr_spec('star@a.star@example.com') | |||
| + | |||
| + with self.assertRaises(errors.HeaderParseError): | |||
| + parser.get_addr_spec('star@a@example.com') | |||
| + | |||
| + with self.assertRaises(errors.HeaderParseError): | |||
| + parser.get_addr_spec('star@172.17.0.1@example.com') | |||
| + | |||
| # get_obs_route | |||
| def test_get_obs_route_simple(self): | |||
| diff --git a/Lib/test/test_email/test_email.py b/Lib/test/test_email/test_email.py | |||
| index c29cc56203b1f..aa775881c5521 100644 | |||
| --- a/Lib/test/test_email/test_email.py | |||
| +++ b/Lib/test/test_email/test_email.py | |||
| @@ -3041,6 +3041,20 @@ def test_parseaddr_empty(self): | |||
| self.assertEqual(utils.parseaddr('<>'), ('', '')) | |||
| self.assertEqual(utils.formataddr(utils.parseaddr('<>')), '') | |||
| + def test_parseaddr_multiple_domains(self): | |||
| + self.assertEqual( | |||
| + utils.parseaddr('a@b@c'), | |||
| + ('', '') | |||
| + ) | |||
| + self.assertEqual( | |||
| + utils.parseaddr('a@b.c@c'), | |||
| + ('', '') | |||
| + ) | |||
| + self.assertEqual( | |||
| + utils.parseaddr('a@172.17.0.1@c'), | |||
| + ('', '') | |||
| + ) | |||
| + | |||
| def test_noquote_dump(self): | |||
| self.assertEqual( | |||
| utils.formataddr(('A Silly Person', 'person@dom.ain')), | |||
| diff --git a/Misc/NEWS.d/next/Security/2019-05-04-13-33-37.bpo-34155.MJll68.rst b/Misc/NEWS.d/next/Security/2019-05-04-13-33-37.bpo-34155.MJll68.rst | |||
| new file mode 100644 | |||
| index 0000000000000..50292e29ed1d2 | |||
| --- /dev/null | |||
| +++ b/Misc/NEWS.d/next/Security/2019-05-04-13-33-37.bpo-34155.MJll68.rst | |||
| @@ -0,0 +1 @@ | |||
| +Fix parsing of invalid email addresses with more than one ``@`` (e.g. a@b@c.com.) to not return the part before 2nd ``@`` as valid email address. Patch by maxking & jpic. | |||