Staging
v0.5.1
https://github.com/python/cpython
Revision 5b2d9ddf69cecfb9ad4e687fab3f34ecc5a9ea4f authored by R. David Murray on 09 January 2011, 02:35:24 UTC, committed by R. David Murray on 09 January 2011, 02:35:24 UTC
This makes Header.encode throw a HeaderParseError if it winds up
formatting a header such that a continuation line has no leading
whitespace and looks like a header.  Since Header accepts values
containing newlines and preserves them (and this is by design), without
this fix any program that took user input (say, a subject in a web form)
and passed it to the email package as a header was vulnerable to header
injection attacks.  (As far as we know this has never been exploited.)

Thanks to Jakub Wilk for reporting this vulnerability.
1 parent e3ee66f
History
Tip revision: 5b2d9ddf69cecfb9ad4e687fab3f34ecc5a9ea4f authored by R. David Murray on 09 January 2011, 02:35:24 UTC
#5871: protect against header injection attacks.
Tip revision: 5b2d9dd
File Mode Size
Doc
Grammar
Include
Lib
Mac
Misc
Modules
Objects
PC
PCbuild
Parser
Python
Tools
.bzrignore -rw-r--r-- 556 bytes
.gitignore -rw-r--r-- 566 bytes
.hgeol -rw-r--r-- 503 bytes
.hgignore -rw-r--r-- 771 bytes
.hgtags -rw-r--r-- 4.1 KB
LICENSE -rw-r--r-- 14.2 KB
Makefile.pre.in -rw-r--r-- 41.9 KB
README -rw-r--r-- 6.4 KB
configure -rwxr-xr-x 395.0 KB
configure.in -rw-r--r-- 121.9 KB
install-sh -rwxr-xr-x 7.0 KB
pyconfig.h.in -rw-r--r-- 33.8 KB
setup.py -rw-r--r-- 79.4 KB

README

back to top