[3.12] [CVE-2023-27043] gh-102988: Reject malformed addresses in email.parseaddr() (GH-111116) by encukou · Pull Request #123766 · python/cpython

encukou

…n email.parseaddr() (pythonGH-111116)

Detect email address parsing errors and return empty tuple to
indicate the parsing error (old API). Add an optional 'strict'
parameter to getaddresses() and parseaddr() functions. Patch by
Thomas Dwyer.

Co-Authored-By: Thomas Dwyer <github@tomd.tel>
(cherry picked from commit 4a153a1)

miketheman added a commit to miketheman/warehouse that referenced this pull request

Sep 12, 2024

Now that Python validates the addresses more strictly, we won't hit the
condition any longer.

If we wish to preserve this condition, we could also pass `strict=False`
to `getaddresses()`, but that seems to be counter to our desire of
having a valid email address.

Refs: python/cpython#123766

Signed-off-by: Mike Fiedler <miketheman@gmail.com>

ewdurbin pushed a commit to pypi/warehouse that referenced this pull request

Sep 13, 2024

* chore: update Python 3.12.6

Refs: https://www.python.org/downloads/release/python-3126/

Signed-off-by: Mike Fiedler <miketheman@gmail.com>

* chore: remove unreachable condition

Now that Python validates the addresses more strictly, we won't hit the
condition any longer.

If we wish to preserve this condition, we could also pass `strict=False`
to `getaddresses()`, but that seems to be counter to our desire of
having a valid email address.

Refs: python/cpython#123766

Signed-off-by: Mike Fiedler <miketheman@gmail.com>

* test: refactor test case to parametrize

Extract test cases from inline to make it clearer which permutations are
being tested.

Signed-off-by: Mike Fiedler <miketheman@gmail.com>

---------

Signed-off-by: Mike Fiedler <miketheman@gmail.com>