From 235bc86dec7fb5d0c5fdb9d448b429db6d66fe55 Mon Sep 17 00:00:00 2001 From: Abhilash Raj Date: Wed, 17 Jul 2019 09:44:27 -0700 Subject: [PATCH 1/2] [3.5] bpo-37461: Fix infinite loop in parsing of specially crafted email headers (GH-14794) * bpo-37461: Fix infinite loop in parsing of specially crafted email headers. Some crafted email header would cause the get_parameter method to run in an infinite loop causing a DoS attack surface when parsing those headers. This patch fixes that by making sure the DQUOTE character is handled to prevent going into an infinite loop. (cherry picked from commit a4a994bd3e619cbaff97610a1cee8ffa87c672f5) Co-authored-by: Abhilash Raj --- Lib/email/_header_value_parser.py | 3 +++ Lib/test/test_email/test__header_value_parser.py | 7 +++++++ .../next/Security/2019-07-16-08-11-00.bpo-37461.1Ahz7O.rst | 2 ++ 3 files changed, 12 insertions(+) create mode 100644 Misc/NEWS.d/next/Security/2019-07-16-08-11-00.bpo-37461.1Ahz7O.rst diff --git a/Lib/email/_header_value_parser.py b/Lib/email/_header_value_parser.py index 37a9fbcbb67d7c0..f9d36d7420ab941 100644 --- a/Lib/email/_header_value_parser.py +++ b/Lib/email/_header_value_parser.py @@ -2769,6 +2769,9 @@ def get_parameter(value): while value: if value[0] in WSP: token, value = get_fws(value) + elif value[0] == '"': + token = ValueTerminal('"', 'DQUOTE') + value = value[1:] else: token, value = get_qcontent(value) v.append(token) diff --git a/Lib/test/test_email/test__header_value_parser.py b/Lib/test/test_email/test__header_value_parser.py index b1e7dff2405d882..8e499486a1990f3 100644 --- a/Lib/test/test_email/test__header_value_parser.py +++ b/Lib/test/test_email/test__header_value_parser.py @@ -2563,6 +2563,13 @@ def mime_parameters_as_value(self, # Defects are apparent missing *0*, and two 'out of sequence'. [errors.InvalidHeaderDefect]*3), + # bpo-37461: Check that we don't go into an infinite loop. + 'extra_dquote': ( + 'r*="\'a\'\\"', + ' r="\\""', + 'r*=\'a\'"', + [('r', '"')], + [errors.InvalidHeaderDefect]*2), } @parameterize diff --git a/Misc/NEWS.d/next/Security/2019-07-16-08-11-00.bpo-37461.1Ahz7O.rst b/Misc/NEWS.d/next/Security/2019-07-16-08-11-00.bpo-37461.1Ahz7O.rst new file mode 100644 index 000000000000000..4bfd350c0b404eb --- /dev/null +++ b/Misc/NEWS.d/next/Security/2019-07-16-08-11-00.bpo-37461.1Ahz7O.rst @@ -0,0 +1,2 @@ +Fix an inifite loop when parsing specially crafted email headers. Patch by +Abhilash Raj. From 864d39a2b18a1c9088776117fa3a8f4f47a08eb8 Mon Sep 17 00:00:00 2001 From: Abhilash Raj Date: Wed, 4 Sep 2019 22:23:25 -0700 Subject: [PATCH 2/2] Update Misc/NEWS.d/next/Security/2019-07-16-08-11-00.bpo-37461.1Ahz7O.rst Co-Authored-By: Ashwin Ramaswami --- .../next/Security/2019-07-16-08-11-00.bpo-37461.1Ahz7O.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Misc/NEWS.d/next/Security/2019-07-16-08-11-00.bpo-37461.1Ahz7O.rst b/Misc/NEWS.d/next/Security/2019-07-16-08-11-00.bpo-37461.1Ahz7O.rst index 4bfd350c0b404eb..9d47578c6277106 100644 --- a/Misc/NEWS.d/next/Security/2019-07-16-08-11-00.bpo-37461.1Ahz7O.rst +++ b/Misc/NEWS.d/next/Security/2019-07-16-08-11-00.bpo-37461.1Ahz7O.rst @@ -1,2 +1,2 @@ -Fix an inifite loop when parsing specially crafted email headers. Patch by +Fix an infinite loop when parsing specially crafted email headers. Patch by Abhilash Raj.