diff options
| author | Abhilash Raj <maxking@users.noreply.github.com> | 2019-07-17 09:44:27 -0700 |
|---|---|---|
| committer | Barry Warsaw <barry@python.org> | 2019-07-17 09:44:27 -0700 |
| commit | a4a994bd3e619cbaff97610a1cee8ffa87c672f5 (patch) | |
| tree | 6aee3d24c4a984481adf2921c31108635b0857ce /Lib/test/test_email/test__header_value_parser.py | |
| parent | 82494aa6d947c4a320c09c58fe0f100cdcf7af0b (diff) | |
| download | cpython-git-a4a994bd3e619cbaff97610a1cee8ffa87c672f5.tar.gz | |
bpo-37461: Fix infinite loop in parsing of specially crafted email headers (GH-14794)
* bpo-37461: Fix infinite loop in parsing of specially crafted email headers.
Some crafted email header would cause the get_parameter method to run in an
infinite loop causing a DoS attack surface when parsing those headers. This
patch fixes that by making sure the DQUOTE character is handled to prevent
going into an infinite loop.
Diffstat (limited to 'Lib/test/test_email/test__header_value_parser.py')
| -rw-r--r-- | Lib/test/test_email/test__header_value_parser.py | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/Lib/test/test_email/test__header_value_parser.py b/Lib/test/test_email/test__header_value_parser.py index c4e1a9f994..a83915d6d0 100644 --- a/Lib/test/test_email/test__header_value_parser.py +++ b/Lib/test/test_email/test__header_value_parser.py @@ -2710,6 +2710,13 @@ class Test_parse_mime_parameters(TestParserMixin, TestEmailBase): # Defects are apparent missing *0*, and two 'out of sequence'. [errors.InvalidHeaderDefect]*3), + # bpo-37461: Check that we don't go into an infinite loop. + 'extra_dquote': ( + 'r*="\'a\'\\"', + ' r="\\""', + 'r*=\'a\'"', + [('r', '"')], + [errors.InvalidHeaderDefect]*2), } @parameterize |