gh-102988: Detect email address parsing errors and return empty tuple to indicate the parsing error (old API) #105127

tdwyer · 2023-05-31T02:07:28Z

This PR is designed to detect parsing errors and return an empty tuple to indicate the parsing error. Additionally, this PR updates the test_email.py to check for these bugs, as well as, adds some other wacky Address Headers that are in the examples of RFC 2822 and makes sure they are being parsed correctly.

I realize that this PR dose not actually track down the bug and fix it. It simply detects the error has happened and returns a parsing error. However, Lib/email/utils.py is a much simpler file than Lib/email/_parseaddr.py, so it is much easier to review this change. Additionally, there are actually multiple bugs which are causing erroneous output. Tracing the code flow for each and fixing them would be prone to error considering all of the wacky stuff that RFC 2822 allows for in Address headers. Finally, this change is actually rather simple.

Issue: [CVE-2023-27043] Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple #102988

… tuple to indicate the parsing error (old API)

bedevere-bot · 2023-05-31T02:07:34Z

Most changes to Python require a NEWS entry.

Please add it using the blurb_it web app or the blurb command-line tool.

tdwyer · 2023-05-31T02:12:13Z

I had to create a new PR to replace the last one because Git got all messed up.

This is the old PR: #102990

bedevere-bot · 2023-05-31T03:29:15Z

Most changes to Python require a NEWS entry.

Please add it using the blurb_it web app or the blurb command-line tool.

Lib/email/utils.py

Lib/test/test_email/test_email.py

tdwyer · 2023-06-07T01:23:17Z

Hum... it looks like CVE-2019-16056 was only fixed for parseaddr() and not getaddresses(). This PR happens to fix that too.
https://www.cve.org/CVERecord?id=CVE-2019-16056

getaddresses()

a = ['a@b.com<z@x.com>']
getaddresses(a)
[('', 'a@b.com'), ('', 'z@x.com')]

parseaddr()

a = ['a@b.com<z@x.com>']
parseaddr(a)
('', 'a@b.com<z@x.com>')

tdwyer · 2023-06-07T01:25:03Z

Should I add that NEWS entry that the Bot is asking for?

CharlieZhao95 · 2023-06-07T01:31:07Z

Should I add that NEWS entry that the Bot is asking for?

I think it is needed, NEWS entry is required for most code modifications 😄. Please see: https://devguide.python.org/core-developers/committing/#updating-news-and-what-s-new-in-python

tdwyer · 2023-06-14T03:11:22Z

I added NEWS entry, and all Unit tests have passed.

…sList

gpshead · 2023-07-10T22:55:39Z

Docs updated, auto-merge set. The backports beyond 3.12 will require manual work to get version numbered things right. I'd like to let this bake in 3.12beta4 & 3.12rc1 for a while first to see if any practical issues arise before landing the backports in older releases.

it is a security issue so we could backport it all the way to 3.8, but lets see how things go first. it is not high severity.

miss-islington · 2023-07-10T23:00:59Z

Thanks @tdwyer for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12.
🐍🍒⛏🤖

miss-islington · 2023-07-10T23:01:07Z

Sorry, @tdwyer and @gpshead, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker 18dfbd035775c15533d13a98e56b1d2bf5c65f00 3.11

… tuple to indicate the parsing error (old API) (pythonGH-105127) Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). This fixes or at least ameliorates CVE-2023-27043. --------- (cherry picked from commit 18dfbd0) Co-authored-by: Thomas Dwyer <github@tomd.tel> Co-authored-by: Gregory P. Smith <greg@krypto.org>

miss-islington · 2023-07-10T23:01:10Z

Sorry @tdwyer and @gpshead, I had trouble checking out the 3.10 backport branch.
Please retry by removing and re-adding the "needs backport to 3.10" label.
Alternatively, you can backport using cherry_picker on the command line.
cherry_picker 18dfbd035775c15533d13a98e56b1d2bf5c65f00 3.10

bedevere-bot · 2023-07-10T23:01:11Z

GH-106612 is a backport of this pull request to the 3.12 branch.

…y tuple to indicate the parsing error (old API) (GH-105127) (#106612) gh-102988: Detect email address parsing errors and return empty tuple to indicate the parsing error (old API) (GH-105127) Detect email address parsing errors and return empty tuple to indicate the parsing error (old API). This fixes or at least ameliorates CVE-2023-27043. --------- (cherry picked from commit 18dfbd0) Co-authored-by: Thomas Dwyer <github@tomd.tel> Co-authored-by: Gregory P. Smith <greg@krypto.org>

tdwyer-wish · 2023-07-12T00:34:48Z

Hello @gpshead Are you going to take care of the backports/cherrypick for 3.10 and 3.11 I'd do them but I've never done that before... Hum, actually I don't think I have permission to do that.

gpshead · 2023-07-12T00:50:02Z

i'll do them, the issue remains assigned to me as a reminder. (anyone can do it, it's just a matter of creating your PR as a fork of the relevant release branch and selecting the matching base branch in the github ui at pr creation time)

CharlieZhao95 · 2023-07-12T00:53:22Z

Hello @gpshead Are you going to take care of the backports/cherrypick for 3.10 and 3.11 I'd do them but I've never done that before... Hum, actually I don't think I have permission to do that.

Please see https://devguide.python.org/core-developers/committing/#backporting-changes-to-an-older-version for details.

gpshead · 2023-07-12T18:03:50Z

this appears to have caused #106669

mcepl · 2023-07-13T21:15:04Z

Doc/library/email.utils.rst

@@ -87,7 +92,7 @@ of the new API.
   This method returns a list of 2-tuples of the form returned by ``parseaddr()``.
   *fieldvalues* is a sequence of header field values as might be returned by
   :meth:`Message.get_all <email.message.Message.get_all>`.  Here's a simple
-   example that gets all the recipients of a message::


@tdwyer Is this right? Isn’t the next paragraph still a literal block? Why have you removed this colon?

…g errors and return empty tuple to indicate the parsing error (old API) (python#105127)" This reverts commit 18dfbd0. See python#106669.

…#105127)" (#106733) This reverts commit 18dfbd0. Adds a regression test from the issue. See #106669.

… parsing errors ... (pythonGH-105127)" (pythonGH-106733) This reverts commit 18dfbd0. Adds a regression test from the issue. See python#106669.. (cherry picked from commit a31dea1) Co-authored-by: Gregory P. Smith <greg@krypto.org>

…ors ... (GH-105127)" (GH-106733) (#106941) This reverts commit 18dfbd0. Adds a regression test from the issue. See #106669.. (cherry picked from commit a31dea1)

pythongh-102988: Detect email address parsing errors and return empty…

81098ed

… tuple to indicate the parsing error (old API)

tdwyer requested a review from a team as a code owner May 31, 2023 02:07

bedevere-bot added the awaiting review label May 31, 2023

bedevere-bot mentioned this pull request May 31, 2023

[CVE-2023-27043] Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple #102988

Closed

tdwyer mentioned this pull request May 31, 2023

gh-102988: Detect email address parsing errors and return empty tuple to indicate the parsing error (old API) #102990

Closed

tdwyer changed the title ~~gh-102988: Detect email address parsing errors and return empty tupleto indicate the parsing error (old API)~~ gh-102988: Detect email address parsing errors and return empty tuple to indicate the parsing error (old API) May 31, 2023

r-prefix strs with \ in the tests

ecbb31c

reword getaddresses docstring

d8d2831

This comment was marked as duplicate.

Sign in to view

gpshead reviewed May 31, 2023

View reviewed changes

Lib/email/utils.py Outdated Show resolved Hide resolved

CharlieZhao95 reviewed Jun 6, 2023

View reviewed changes

Lib/email/utils.py Outdated Show resolved Hide resolved

Lib/test/test_email/test_email.py Outdated Show resolved Hide resolved

Update comment for getaddresses() and fix broken email test

b44a0b7

This comment was marked as duplicate.

Sign in to view

Add NEWS

40002d9

tdwyer requested review from gpshead and CharlieZhao95 June 17, 2023 19:05

This comment was marked as resolved.

Sign in to view

Merge branch 'main' into fix_issues102988

86ffb57

This comment was marked as resolved.

Sign in to view

Fix NEWS entry. It was not a Module its Class email._parseaddr.Addres…

302ee76

…sList

This comment was marked as spam.

Sign in to view

gpshead added the type-security A security issue label Jul 10, 2023

Add versionchanged to parseaddr, add What's New.

f96a3ff

gpshead self-assigned this Jul 10, 2023

gpshead removed needs backport to 3.8 needs backport to 3.9 only security fixes labels Jul 10, 2023

gpshead approved these changes Jul 10, 2023

View reviewed changes

bedevere-bot added awaiting merge and removed awaiting review labels Jul 10, 2023

gpshead enabled auto-merge (squash) July 10, 2023 22:49

gpshead merged commit 18dfbd0 into python:main Jul 10, 2023

bedevere-bot removed the awaiting merge label Jul 10, 2023

bedevere-bot removed the needs backport to 3.12 bug and security fixes label Jul 10, 2023

mcepl reviewed Jul 13, 2023

View reviewed changes

gpshead mentioned this pull request Jul 14, 2023

gh-106669: Revert "gh-102988: Detect email address parsing errors ... (#105127)" #106733

Merged

gpshead added a commit that referenced this pull request Jul 21, 2023

gh-106669: Revert "gh-102988: Detect email address parsing errors ... (…

a31dea1

…#105127)" (#106733) This reverts commit 18dfbd0. Adds a regression test from the issue. See #106669.

gpshead mentioned this pull request Dec 14, 2023

[CVE-2023-27043] gh-102988: Reject malformed addresses in email.parseaddr() #111116

Merged

smoser mentioned this pull request Feb 26, 2024

python-3.11 - cherry pick upstream patch for CVE-2023-27043 wolfi-dev/os#13586

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

gh-102988: Detect email address parsing errors and return empty tuple to indicate the parsing error (old API) #105127

gh-102988: Detect email address parsing errors and return empty tuple to indicate the parsing error (old API) #105127

tdwyer commented May 31, 2023 •

edited by bedevere-bot

Loading

bedevere-bot commented May 31, 2023

tdwyer commented May 31, 2023

bedevere-bot commented May 31, 2023

This comment was marked as duplicate.

This comment was marked as duplicate.

tdwyer commented Jun 7, 2023

tdwyer commented Jun 7, 2023

CharlieZhao95 commented Jun 7, 2023

tdwyer commented Jun 14, 2023

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as spam.

gpshead commented Jul 10, 2023

miss-islington commented Jul 10, 2023

miss-islington commented Jul 10, 2023

miss-islington commented Jul 10, 2023

bedevere-bot commented Jul 10, 2023

tdwyer-wish commented Jul 12, 2023 •

edited

Loading

gpshead commented Jul 12, 2023

CharlieZhao95 commented Jul 12, 2023

gpshead commented Jul 12, 2023

mcepl Jul 13, 2023

gh-102988: Detect email address parsing errors and return empty tuple to indicate the parsing error (old API) #105127

gh-102988: Detect email address parsing errors and return empty tuple to indicate the parsing error (old API) #105127

Conversation

tdwyer commented May 31, 2023 • edited by bedevere-bot Loading

bedevere-bot commented May 31, 2023

tdwyer commented May 31, 2023

bedevere-bot commented May 31, 2023

This comment was marked as duplicate.

This comment was marked as duplicate.

tdwyer commented Jun 7, 2023

tdwyer commented Jun 7, 2023

CharlieZhao95 commented Jun 7, 2023

tdwyer commented Jun 14, 2023

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as spam.

gpshead commented Jul 10, 2023

miss-islington commented Jul 10, 2023

miss-islington commented Jul 10, 2023

miss-islington commented Jul 10, 2023

bedevere-bot commented Jul 10, 2023

tdwyer-wish commented Jul 12, 2023 • edited Loading

gpshead commented Jul 12, 2023

CharlieZhao95 commented Jul 12, 2023

gpshead commented Jul 12, 2023

mcepl Jul 13, 2023

Choose a reason for hiding this comment

tdwyer commented May 31, 2023 •

edited by bedevere-bot

Loading

tdwyer-wish commented Jul 12, 2023 •

edited

Loading