Issue 39073: [security] email module incorrect handling of CR and LF newline characters in Address objects.

big-bob:t spaans$ cat fak.py
import sys

from email.message import EmailMessage
from email.policy import SMTP
from email.headerregistry import Address

msg = EmailMessage(policy=SMTP)

a = Address(display_name='Extra Extra Read All About It This Line Does Not Fit In 80 Characters So Should Be Wrapped <dev@local>\r\nX:', addr_spec='evil@local')
msg['To'] = a
print(sys.version)
print(msg.as_string())
big-bob:t spaans$ python3.5 fak.py
3.5.2 (default, Jul 16 2019, 13:40:43) 
[GCC 4.2.1 Compatible Apple LLVM 10.0.1 (clang-1001.0.46.4)]
To: "Extra Extra Read All About It This Line Does Not Fit In 80 Characters So Should Be Wrapped <dev@local>
X:" <evil@local>


big-bob:t spaans$ python3.8 fak.py
3.8.0 (default, Dec 17 2019, 13:32:18) 
[Clang 11.0.0 (clang-1100.0.33.16)]
To: Extra Extra Read All About It This Line Does Not Fit In 80 Characters So
 Should Be Wrapped <dev@local>
X: <evil@local>

As can be seen above, 3.5 wraps the realname in a double quote, but 3.8 fails to do so. Note that 3.5 also does not add a whitespace in front of the line starting with "X:", so it is also not merged with the previous line when parsing.

I guess we'll have to disallow \r and \n in displaynames for now.

Hmm.  Yes, \r\n should be disallowed in the arguments to Address.  I thought it already was, so that's a bug.  That bug produces the other apparent bug as well: because the X: was treated as a separate line, the previous header did not need double quotes so they are no longer added.

So there's no 3.8 specific bug here, but there is a bug.

Thanks for the PR.  I've made some review comments.

New changeset 614f17211c5fc0e5b828be1d3320661d1038fe8f by Ashwin Ramaswami in branch 'master':
bpo-39073: validate Address parts to disallow CRLF (#19007)
https://github.com/python/cpython/commit/614f17211c5fc0e5b828be1d3320661d1038fe8f

Thanks!

There are 3 open PRs for the backport of this to 3.6, 3.7, and 3.8.  It looks like they just need to be approved and miss-islington will take care of the rest.

New changeset 75635c6095bcfbb9fccc239115d3d03ae20a307f by Miss Islington (bot) in branch '3.8':
bpo-39073: validate Address parts to disallow CRLF (GH-19007)
https://github.com/python/cpython/commit/75635c6095bcfbb9fccc239115d3d03ae20a307f

New changeset a93bf82980d7c02217a088bafa193f32a4d13abb by Miss Islington (bot) in branch '3.7':
bpo-39073: validate Address parts to disallow CRLF (GH-19007)
https://github.com/python/cpython/commit/a93bf82980d7c02217a088bafa193f32a4d13abb

I created PR 20450: backport to 3.5, since it's a security fix.

FYI I created https://python-security.readthedocs.io/vuln/email-address-header-injection.html to track fixes of this vulnerability.

New changeset 7df32f844efed33ca781a016017eab7050263b90 by Miss Islington (bot) in branch '3.6':
bpo-39073: validate Address parts to disallow CRLF (GH-19007) (#19224)
https://github.com/python/cpython/commit/7df32f844efed33ca781a016017eab7050263b90

New changeset f91a0b6df14d6c5133fe3d5889fad7d84fc0c046 by Victor Stinner in branch '3.5':
bpo-39073: validate Address parts to disallow CRLF (#19007) (#20450)
https://github.com/python/cpython/commit/f91a0b6df14d6c5133fe3d5889fad7d84fc0c046

Merged for release in 3.9.0a6, 3.8.4, 3.7.8, 3.6.11, and 3.5.10.

stage: patch review -> resolved

pull_requests: + pull_request19704
stage: backport needed -> patch review

pull_requests: + pull_request18352
stage: patch review