Remove newline characters from uu encoding methods

[stealthcopter]

BPO	38945
Nosy	@gvanrossum, @larryhastings, @ned-deily, @miss-islington, @stealthcopter
PRs	bpo-38945: UU Encoding: Removed newline characters from uu encoding methods #17418 [3.8] bpo-38945: UU Encoding: Don't let newline in filename corrupt the output format (GH-17418) #17442 [3.7] bpo-38945: UU Encoding: Don't let newline in filename corrupt the output format (GH-17418) #17443 [3.6] bpo-38945: UU Encoding: Don't let newline in filename corrupt the output format (GH-17418) #17444 [3.5] bpo-38945: UU Encoding: Don't let newline in filename corrupt the output format (GH-17418) #17445 [2.7] bpo-38945: UU Encoding: Don't let newline in filename corrupt the output format (GH-17418) #17452

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2020-03-21.08:39:28.590>
created_at = <Date 2019-11-30.17:06:01.695>
labels = ['type-security', '3.7', '3.8', '3.9']
title = 'Remove newline characters from uu encoding methods'
updated_at = <Date 2020-03-21.08:39:28.590>
user = 'https://github.com/stealthcopter'

bugs.python.org fields:

activity = <Date 2020-03-21.08:39:28.590>
actor = 'larry'
assignee = 'none'
closed = True
closed_date = <Date 2020-03-21.08:39:28.590>
closer = 'larry'
components = []
creation = <Date 2019-11-30.17:06:01.695>
creator = 'stealthcopter'
dependencies = []
files = []
hgrepos = []
issue_num = 38945
keywords = ['patch']
message_count = 8.0
messages = ['357660', '357730', '357731', '357732', '357734', '357735', '357756', '364726']
nosy_count = 5.0
nosy_names = ['gvanrossum', 'larry', 'ned.deily', 'miss-islington', 'stealthcopter']
pr_nums = ['17418', '17442', '17443', '17444', '17445', '17452']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue38945'
versions = ['Python 2.7', 'Python 3.5', 'Python 3.6', 'Python 3.7', 'Python 3.8', 'Python 3.9']

[stealthcopter]

Filenames passed to the UU encoding methods (uu.py and uu_codec.py) that contain a newline character will overflow data into the UU content section. This can potentially be used to inject replace or corrupt data content in a file during the decode process.

Initially discussed via the PSRT but deemed low risk so suggested I create a PR with the changes and a BPO.

[gvanrossum]

New changeset a62ad47 by Guido van Rossum (Matthew Rollings) in branch 'master':
bpo-38945: UU Encoding: Don't let newline in filename corrupt the output format (bpo-17418)
a62ad47

[miss-islington]

New changeset 87f2d26 by Miss Islington (bot) in branch '3.7':
bpo-38945: UU Encoding: Don't let newline in filename corrupt the output format (GH-17418)
87f2d26

[miss-islington]

New changeset 8859fc6 by Miss Islington (bot) in branch '3.8':
bpo-38945: UU Encoding: Don't let newline in filename corrupt the output format (GH-17418)
8859fc6

[ned-deily]

New changeset 30afc91 by Ned Deily (Miss Islington (bot)) in branch '3.6':
bpo-38945: UU Encoding: Don't let newline in filename corrupt the output format (GH-17418) (GH-17444)
30afc91

[gvanrossum]

(Now waiting for 2.7 backport by stealthcopter.)

[gvanrossum]

New changeset a016d4e by Guido van Rossum (Matthew Rollings) in branch '2.7':
[2.7] bpo-38945: UU Encoding: Don't let newline in filename corrupt the output format (GH-17418). (bpo-17452)
a016d4e

[larryhastings]

New changeset 8835f46 by Ned Deily in branch '3.5':
bpo-38945: UU Encoding: Don't let newline in filename corrupt the output format (GH-17418) (GH-17444) (bpo-17445)
8835f46