You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
56 lines
2.3 KiB
56 lines
2.3 KiB
From 391511ccaaf0050970dfbe95bf2df1bcf6c33440 Mon Sep 17 00:00:00 2001
|
|
From: "Miss Islington (bot)"
|
|
<31488909+miss-islington@users.noreply.github.com>
|
|
Date: Wed, 17 Jul 2019 10:02:05 -0700
|
|
Subject: [PATCH] bpo-37461: Fix infinite loop in parsing of specially crafted
|
|
email headers (GH-14794)
|
|
|
|
* bpo-37461: Fix infinite loop in parsing of specially crafted email headers.
|
|
|
|
Some crafted email header would cause the get_parameter method to run in an
|
|
infinite loop causing a DoS attack surface when parsing those headers. This
|
|
patch fixes that by making sure the DQUOTE character is handled to prevent
|
|
going into an infinite loop.
|
|
(cherry picked from commit a4a994bd3e619cbaff97610a1cee8ffa87c672f5)
|
|
|
|
Co-authored-by: Abhilash Raj <maxking@users.noreply.github.com>
|
|
---
|
|
Lib/email/_header_value_parser.py | 3 +++
|
|
Lib/test/test_email/test__header_value_parser.py | 7 +++++++
|
|
.../next/Security/2019-07-16-08-11-00.bpo-37461.1Ahz7O.rst | 2 ++
|
|
3 files changed, 12 insertions(+)
|
|
create mode 100644 Misc/NEWS.d/next/Security/2019-07-16-08-11-00.bpo-37461.1Ahz7O.rst
|
|
|
|
--- a/Lib/email/_header_value_parser.py
|
|
+++ b/Lib/email/_header_value_parser.py
|
|
@@ -2387,6 +2387,9 @@ def get_parameter(value):
|
|
while value:
|
|
if value[0] in WSP:
|
|
token, value = get_fws(value)
|
|
+ elif value[0] == '"':
|
|
+ token = ValueTerminal('"', 'DQUOTE')
|
|
+ value = value[1:]
|
|
else:
|
|
token, value = get_qcontent(value)
|
|
v.append(token)
|
|
--- a/Lib/test/test_email/test__header_value_parser.py
|
|
+++ b/Lib/test/test_email/test__header_value_parser.py
|
|
@@ -2621,6 +2621,13 @@ class Test_parse_mime_parameters(TestPar
|
|
# Defects are apparent missing *0*, and two 'out of sequence'.
|
|
[errors.InvalidHeaderDefect]*3),
|
|
|
|
+ # bpo-37461: Check that we don't go into an infinite loop.
|
|
+ 'extra_dquote': (
|
|
+ 'r*="\'a\'\\"',
|
|
+ ' r="\\""',
|
|
+ 'r*=\'a\'"',
|
|
+ [('r', '"')],
|
|
+ [errors.InvalidHeaderDefect]*2),
|
|
}
|
|
|
|
@parameterize
|
|
--- /dev/null
|
|
+++ b/Misc/NEWS.d/next/Security/2019-07-16-08-11-00.bpo-37461.1Ahz7O.rst
|
|
@@ -0,0 +1,2 @@
|
|
+Fix an inifite loop when parsing specially crafted email headers. Patch by
|
|
+Abhilash Raj.
|