Join GitHub today
GitHub is home to over 40 million developers working together to host and review code, manage projects, and build software together.
Sign upbpo-39040: Fix parsing of email headers with whitespace between encoded-words. #17620
Conversation
…ed-words. In certain malformed content-disposition headers, parameter values are quoted and split as encoded words on two lines with extra whitespaces. This fixes the issue by removing the extra whitespace between the two encoded words.
| except errors.HeaderParseError: | ||
| token, value = get_qcontent(value) | ||
|
|
This comment has been minimized.
This comment has been minimized.
| if valid_ew and len(bare_quoted_string) > 1: | ||
| if (bare_quoted_string[-1].token_type == 'fws' and | ||
| bare_quoted_string[-2].token_type == 'encoded-word'): | ||
|
|
This comment has been minimized.
This comment has been minimized.
| @@ -873,6 +873,16 @@ def content_disp_as_value(self, | |||
| {'filename': 'foo'}, | |||
| [errors.InvalidHeaderDefect]), | |||
|
|
|||
| 'invalid_value_with_fws_bw_ew': ( | |||
This comment has been minimized.
This comment has been minimized.
bitdancer
Dec 16, 2019
Member
'value' in the preceding test names is the value of the header. The thing being tested here is the value of the parameter. Confusing, I know :) Also, I suggest spelling out bw, which at least to my eyes isn't obvious: invalid_parameter_value_with_fws_between_ew".
Also, I suggest adding a test with an EW in the middle of regular tokens, to make sure white space that is not between EWs is handled correctly. Your code should, but we want to guard against future breakage.
| @@ -0,0 +1,2 @@ | |||
| Fix parsing of invalid Content-Disposition email headers by collapsing | |||
| whitespace between encoded words in a bare-quote-string. | |||
This comment has been minimized.
This comment has been minimized.
bitdancer
Dec 16, 2019
Member
This isn't specific to the content-disposition header, it applies to any mime header, since in theory any mime header can have paramaters. So, 'Fix parsing of invalid mime header parameters by...'.
|
Oops, I forgot to start a review :( |
This comment has been minimized.
This comment has been minimized.
bedevere-bot
commented
Dec 16, 2019
|
When you're done making the requested changes, leave the comment: |
maxking commentedDec 16, 2019
•
edited by bedevere-bot
In certain malformed content-disposition headers, parameter values are quoted
and split as encoded words on two lines with extra whitespaces. This fixes the
issue by removing the extra whitespace between the two encoded words.
https://bugs.python.org/issue39040