bpo-37461: Fix infinite loop in parsing of specially crafted email headers #14794

maxking · 2019-07-16T15:08:57Z

Some crafted email header would cause the get_parameter method to run in an
infinite loop causing a DoS attack surface when parsing those headers. This
patch fixes that by making sure the DQUOTE character is handled to prevent
going into an infinite loop.

https://bugs.python.org/issue37461


        bpo-37461: Fix infinite loop in parsing of specially crafted email he…

…aders. Some crafted email header would cause the get_parameter method to run in an infinite loop causing a DoS attack surface when parsing those headers. This patch fixes that by making sure the DQUOTE character is handled to prevent going into an infinite loop.

maxking · 2019-07-16T15:10:04Z

working on adding tests and NEWS entry.


        Add test and NEWS entry.

maxking · 2019-07-16T15:20:24Z

I have added a slightly different test case than given in BPO and that fails with a different exception. I'll keep this PR around and convert it to a WIP, while I figure out what is going on. I may need to dig deeper than I originally thought and might need more time :)

mangrisano · 2019-07-16T17:12:08Z

/cc @bitdancer

aeros · 2019-07-17T07:38:42Z

@maxking Instead of using WIP, you can also start the PR as a draft and open it once the tests are passing. I don't think it's possible to do this for a PR that's already been opened, but just for any future PRs it's a useful feature that I've started using recently.

maxking · 2019-07-17T12:12:54Z

@aeros167 Yeah, I added the tests after I opened the PR, which is why I had to switch it to WIP.

It is a feature in Gitlab, which I more frequently use, where you can switch between WIP PRs (a.k.a draft PR) and normal ones by just adding the WIP: prefix.

Thanks for the tip though, I should have opened a draft PR initially.


        Fix the test to invoke the right infinite loop.

maxking · 2019-07-17T13:37:16Z

So, I think my initial solution was correct, but my test case was wrong. That is a separate bug and I am working on a separate PR to fix that. Pushed a fix and I think this is ready for a review now.

Fingers crossed for the tests (they passed locally) ;-)

miss-islington · 2019-07-17T16:44:31Z

Thanks @maxking for the PR, and @warsaw for merging it 🌮🎉.. I'm working now to backport this PR to: 3.6, 3.7, 3.8.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!

miss-islington · 2019-07-17T16:44:32Z

I'm having trouble backporting to 3.8. Reason: 'Error 110 while writing to socket. Connection timed out.'. Please retry by removing and re-adding the needs backport to 3.8 label.


        bpo-37461: Fix infinite loop in parsing of specially crafted email he…

…aders (pythonGH-14794) * bpo-37461: Fix infinite loop in parsing of specially crafted email headers. Some crafted email header would cause the get_parameter method to run in an infinite loop causing a DoS attack surface when parsing those headers. This patch fixes that by making sure the DQUOTE character is handled to prevent going into an infinite loop. (cherry picked from commit a4a994b) Co-authored-by: Abhilash Raj <maxking@users.noreply.github.com>

bedevere-bot · 2019-07-17T16:44:49Z

GH-14816 is a backport of this pull request to the 3.7 branch.


        bpo-37461: Fix infinite loop in parsing of specially crafted email he…

…aders (pythonGH-14794) * bpo-37461: Fix infinite loop in parsing of specially crafted email headers. Some crafted email header would cause the get_parameter method to run in an infinite loop causing a DoS attack surface when parsing those headers. This patch fixes that by making sure the DQUOTE character is handled to prevent going into an infinite loop. (cherry picked from commit a4a994b) Co-authored-by: Abhilash Raj <maxking@users.noreply.github.com>

bedevere-bot · 2019-07-17T16:44:56Z

GH-14817 is a backport of this pull request to the 3.6 branch.

miss-islington · 2019-07-17T16:45:04Z

Thanks @maxking for the PR, and @warsaw for merging it 🌮🎉.. I'm working now to backport this PR to: 3.6.
🐍🍒⛏🤖

miss-islington · 2019-07-17T16:45:20Z

Thanks @maxking for the PR, and @warsaw for merging it 🌮🎉.. I'm working now to backport this PR to: 3.7.
🐍🍒⛏🤖

miss-islington · 2019-07-17T16:45:20Z

Thanks @maxking for the PR, and @warsaw for merging it 🌮🎉.. I'm working now to backport this PR to: 3.8.
🐍🍒⛏🤖


        bpo-37461: Fix infinite loop in parsing of specially crafted email he…

…aders (pythonGH-14794) * bpo-37461: Fix infinite loop in parsing of specially crafted email headers. Some crafted email header would cause the get_parameter method to run in an infinite loop causing a DoS attack surface when parsing those headers. This patch fixes that by making sure the DQUOTE character is handled to prevent going into an infinite loop. (cherry picked from commit a4a994b) Co-authored-by: Abhilash Raj <maxking@users.noreply.github.com>

bedevere-bot · 2019-07-17T16:45:29Z

GH-14818 is a backport of this pull request to the 3.8 branch.


        bpo-37461: Fix infinite loop in parsing of specially crafted email he…

…aders (GH-14794) * bpo-37461: Fix infinite loop in parsing of specially crafted email headers. Some crafted email header would cause the get_parameter method to run in an infinite loop causing a DoS attack surface when parsing those headers. This patch fixes that by making sure the DQUOTE character is handled to prevent going into an infinite loop. (cherry picked from commit a4a994b) Co-authored-by: Abhilash Raj <maxking@users.noreply.github.com>


        bpo-37461: Fix infinite loop in parsing of specially crafted email he…

…aders (GH-14794) * bpo-37461: Fix infinite loop in parsing of specially crafted email headers. Some crafted email header would cause the get_parameter method to run in an infinite loop causing a DoS attack surface when parsing those headers. This patch fixes that by making sure the DQUOTE character is handled to prevent going into an infinite loop. (cherry picked from commit a4a994b) Co-authored-by: Abhilash Raj <maxking@users.noreply.github.com>


        bpo-37461: Fix infinite loop in parsing of specially crafted email he…

…aders (GH-14794) (GH-14817) Some crafted email header would cause the get_parameter method to run in an infinite loop causing a DoS attack surface when parsing those headers. This patch fixes that by making sure the DQUOTE character is handled to prevent going into an infinite loop. (cherry picked from commit a4a994b) Co-authored-by: Abhilash Raj <maxking@users.noreply.github.com>


        bpo-37461: Fix infinite loop in parsing of specially crafted email he…

…aders (pythonGH-14794) * bpo-37461: Fix infinite loop in parsing of specially crafted email headers. Some crafted email header would cause the get_parameter method to run in an infinite loop causing a DoS attack surface when parsing those headers. This patch fixes that by making sure the DQUOTE character is handled to prevent going into an infinite loop.


        [3.5] bpo-37461: Fix infinite loop in parsing of specially crafted em…

…ail headers (pythonGH-14794) * bpo-37461: Fix infinite loop in parsing of specially crafted email headers. Some crafted email header would cause the get_parameter method to run in an infinite loop causing a DoS attack surface when parsing those headers. This patch fixes that by making sure the DQUOTE character is handled to prevent going into an infinite loop. (cherry picked from commit a4a994b) Co-authored-by: Abhilash Raj <maxking@users.noreply.github.com>


        [3.5] bpo-37461: Fix infinite loop in parsing of specially crafted em…

…ail headers (GH-14794) (#15446) * [3.5] bpo-37461: Fix infinite loop in parsing of specially crafted email headers (GH-14794) Some crafted email header would cause the get_parameter method to run in an infinite loop causing a DoS attack surface when parsing those headers. This patch fixes that by making sure the DQUOTE character is handled to prevent going into an infinite loop. (cherry picked from commit a4a994b) Co-authored-by: Abhilash Raj <maxking@users.noreply.github.com> Co-Authored-By: Ashwin Ramaswami <aramaswamis@gmail.com>


        bpo-37461: Fix infinite loop in parsing of specially crafted email he…

…aders (pythonGH-14794) * bpo-37461: Fix infinite loop in parsing of specially crafted email headers. Some crafted email header would cause the get_parameter method to run in an infinite loop causing a DoS attack surface when parsing those headers. This patch fixes that by making sure the DQUOTE character is handled to prevent going into an infinite loop.


        bpo-37461: Fix infinite loop in parsing of specially crafted email he…

…aders (pythonGH-14794) * bpo-37461: Fix infinite loop in parsing of specially crafted email headers. Some crafted email header would cause the get_parameter method to run in an infinite loop causing a DoS attack surface when parsing those headers. This patch fixes that by making sure the DQUOTE character is handled to prevent going into an infinite loop.

maxking requested a review from python/email-team as a code owner Jul 16, 2019

the-knights-who-say-ni added the CLA signed label Jul 16, 2019

bedevere-bot added the awaiting review label Jul 16, 2019

Add test and NEWS entry.

Verified

This commit was signed with a verified signature.

maxking Abhilash Raj

GPG key ID: 9D9B2BA061D0A67C Learn about signing commits

Loading status checks…

23a1fbc

maxking changed the title ~~bpo-37461: Fix infinite loop in parsing of specially crafted email headers~~ WIP: bpo-37461: Fix infinite loop in parsing of specially crafted email headers Jul 16, 2019

Fix the test to invoke the right infinite loop.

Verified

This commit was signed with a verified signature.

maxking Abhilash Raj

GPG key ID: 9D9B2BA061D0A67C Learn about signing commits

Loading status checks…

cc4ed70

maxking changed the title ~~WIP: bpo-37461: Fix infinite loop in parsing of specially crafted email headers~~ bpo-37461: Fix infinite loop in parsing of specially crafted email headers Jul 17, 2019

warsaw added needs backport to 3.6 needs backport to 3.7 needs backport to 3.8 type-security labels Jul 17, 2019

warsaw approved these changes Jul 17, 2019

View changes

bedevere-bot added awaiting merge and removed awaiting review labels Jul 17, 2019

bedevere-bot removed the awaiting merge label Jul 17, 2019

bedevere-bot removed the needs backport to 3.7 label Jul 17, 2019

bedevere-bot removed the needs backport to 3.6 label Jul 17, 2019

warsaw added the needs backport to 3.6 label Jul 17, 2019

warsaw added needs backport to 3.7 needs backport to 3.8 and removed needs backport to 3.8 labels Jul 17, 2019

bedevere-bot removed the needs backport to 3.8 label Jul 17, 2019

maxking mentioned this pull request Aug 24, 2019

[3.5] bpo-37461: Fix infinite loop in parsing of specially crafted email headers (GH-14794) #15446

Merged

python/cpython

bpo-37461: Fix infinite loop in parsing of specially crafted email headers #14794

bpo-37461: Fix infinite loop in parsing of specially crafted email headers #14794

maxking commented Jul 16, 2019 •

edited by bedevere-bot

This comment has been minimized.

maxking commented Jul 16, 2019

This comment has been minimized.

maxking commented Jul 16, 2019

This comment has been minimized.

mangrisano commented Jul 16, 2019

This comment has been minimized.

aeros commented Jul 17, 2019

This comment has been minimized.

maxking commented Jul 17, 2019

This comment has been minimized.

maxking commented Jul 17, 2019 •

edited

This comment has been minimized.

miss-islington commented Jul 17, 2019

This comment has been minimized.

miss-islington commented Jul 17, 2019

This comment has been minimized.

bedevere-bot commented Jul 17, 2019

This comment has been minimized.

bedevere-bot commented Jul 17, 2019

This comment has been minimized.

miss-islington commented Jul 17, 2019

This comment has been minimized.

miss-islington commented Jul 17, 2019

This comment has been minimized.

miss-islington commented Jul 17, 2019

This comment has been minimized.

bedevere-bot commented Jul 17, 2019

Sponsor python/cpython

python/cpython

Join GitHub today

bpo-37461: Fix infinite loop in parsing of specially crafted email headers #14794

bpo-37461: Fix infinite loop in parsing of specially crafted email headers #14794

Conversation

maxking commented Jul 16, 2019 • edited by bedevere-bot

This comment has been minimized.

maxking commented Jul 16, 2019

This comment has been minimized.

maxking commented Jul 16, 2019

This comment has been minimized.

mangrisano commented Jul 16, 2019

This comment has been minimized.

aeros commented Jul 17, 2019

This comment has been minimized.

maxking commented Jul 17, 2019

This comment has been minimized.

maxking commented Jul 17, 2019 • edited

This comment has been minimized.

miss-islington commented Jul 17, 2019

This comment has been minimized.

miss-islington commented Jul 17, 2019

This comment has been minimized.

bedevere-bot commented Jul 17, 2019

This comment has been minimized.

bedevere-bot commented Jul 17, 2019

This comment has been minimized.

miss-islington commented Jul 17, 2019

This comment has been minimized.

miss-islington commented Jul 17, 2019

This comment has been minimized.

miss-islington commented Jul 17, 2019

This comment has been minimized.

bedevere-bot commented Jul 17, 2019

maxking commented Jul 16, 2019 •

edited by bedevere-bot

maxking commented Jul 17, 2019 •

edited