[PATCH] [3.11] gh-100884: email/_header_value_parser: don't encode list separators...

ListSeparator should not be encoded. This could happen when a long line
pushes its separator to the next line, which would have been encoded.
(cherry picked from commit 09fab93c3d857496c0bd162797fab816c311ee48)

Co-authored-by: Thomas Weißschuh <thomas@t-8ch.de>
(cherry picked from commit 70754d21c288535e86070ca7a6e90dcb670b8593)

Gbp-Pq: Name CVE-2025-1795-1.patch

diff --git a/Lib/email/_header_value_parser.py b/Lib/email/_header_value_parser.py
index e579b3127589b2f818d6d5815cf8be803e2a802d..873e1093341bfddf9bd01b2742248556a68816f7 100644 (file)
--- a/Lib/email/_header_value_parser.py
+++ b/Lib/email/_header_value_parser.py
@@ -951,6 +951,7 @@ class _InvalidEwError(errors.HeaderParseError):
 # up other parse trees.  Maybe should have  tests for that, too.
 DOT = ValueTerminal('.', 'dot')
 ListSeparator = ValueTerminal(',', 'list-separator')
+ListSeparator.as_ew_allowed = False
 RouteComponentMarker = ValueTerminal('@', 'route-component-marker')
 
 #
@@ -2024,7 +2025,7 @@ def get_address_list(value):
             address_list.defects.append(errors.InvalidHeaderDefect(
                 "invalid address in address-list"))
         if value:  # Must be a , at this point.
-            address_list.append(ValueTerminal(',', 'list-separator'))
+            address_list.append(ListSeparator)
             value = value[1:]
     return address_list, value
 

diff --git a/Lib/test/test_email/test__header_value_parser.py b/Lib/test/test_email/test__header_value_parser.py
index 1bdcfa129b4c8717d05bee9118db5e6ea792a005..6c2543db42cf6746dd8b99e0d670ecd433348727 100644 (file)
--- a/Lib/test/test_email/test__header_value_parser.py
+++ b/Lib/test/test_email/test__header_value_parser.py
@@ -2946,6 +2946,11 @@ class TestFolding(TestEmailBase):
             '=?utf-8?q?H=C3=BCbsch?= Kaktus <beautiful@example.com>,\n'
                 ' =?utf-8?q?bei=C3=9Ft_bei=C3=9Ft?= <biter@example.com>\n')
 
+    def test_address_list_with_list_separator_after_fold(self):
+        to = '0123456789' * 8 + '@foo, ä <foo@bar>'
+        self._test(parser.get_address_list(to)[0],
+                   '0123456789' * 8 + '@foo,\n =?utf-8?q?=C3=A4?= <foo@bar>\n')
+
     # XXX Need tests with comments on various sides of a unicode token,
     # and with unicode tokens in the comments.  Spaces inside the quotes
     # currently don't do the right thing.