big-bob:t spaans$ cat fak.py import sys from email.message import EmailMessage from email.policy import SMTP from email.headerregistry import Address msg = EmailMessage(policy=SMTP) a = Address(display_name='Extra Extra Read All About It This Line Does Not Fit In 80 Characters So Should Be Wrapped <dev@local>\r\nX:', addr_spec='evil@local') msg['To'] = a print(sys.version) print(msg.as_string()) big-bob:t spaans$ python3.5 fak.py 3.5.2 (default, Jul 16 2019, 13:40:43) [GCC 4.2.1 Compatible Apple LLVM 10.0.1 (clang-1001.0.46.4)] To: "Extra Extra Read All About It This Line Does Not Fit In 80 Characters So Should Be Wrapped <dev@local> X:" <evil@local> big-bob:t spaans$ python3.8 fak.py 3.8.0 (default, Dec 17 2019, 13:32:18) [Clang 11.0.0 (clang-1100.0.33.16)] To: Extra Extra Read All About It This Line Does Not Fit In 80 Characters So Should Be Wrapped <dev@local> X: <evil@local>

As can be seen above, 3.5 wraps the realname in a double quote, but 3.8 fails to do so. Note that 3.5 also does not add a whitespace in front of the line starting with "X:", so it is also not merged with the previous line when parsing. I guess we'll have to disallow \r and \n in displaynames for now.

Hmm. Yes, \r\n should be disallowed in the arguments to Address. I thought it already was, so that's a bug. That bug produces the other apparent bug as well: because the X: was treated as a separate line, the previous header did not need double quotes so they are no longer added. So there's no 3.8 specific bug here, but there is a bug.

Thanks for the PR. I've made some review comments.

 New changeset 614f17211c5fc0e5b828be1d3320661d1038fe8f by Ashwin Ramaswami in branch 'master': bpo-39073: validate Address parts to disallow CRLF (#19007) https://github.com/python/cpython/commit/614f17211c5fc0e5b828be1d3320661d1038fe8f 

Thanks!

There are 3 open PRs for the backport of this to 3.6, 3.7, and 3.8. It looks like they just need to be approved and miss-islington will take care of the rest.

 New changeset 75635c6095bcfbb9fccc239115d3d03ae20a307f by Miss Islington (bot) in branch '3.8': bpo-39073: validate Address parts to disallow CRLF (GH-19007) https://github.com/python/cpython/commit/75635c6095bcfbb9fccc239115d3d03ae20a307f 

 New changeset a93bf82980d7c02217a088bafa193f32a4d13abb by Miss Islington (bot) in branch '3.7': bpo-39073: validate Address parts to disallow CRLF (GH-19007) https://github.com/python/cpython/commit/a93bf82980d7c02217a088bafa193f32a4d13abb 

I created PR 20450: backport to 3.5, since it's a security fix.

FYI I created https://python-security.readthedocs.io/vuln/email-address-header-injection.html to track fixes of this vulnerability.

 New changeset 7df32f844efed33ca781a016017eab7050263b90 by Miss Islington (bot) in branch '3.6': bpo-39073: validate Address parts to disallow CRLF (GH-19007) (#19224) https://github.com/python/cpython/commit/7df32f844efed33ca781a016017eab7050263b90 

 New changeset f91a0b6df14d6c5133fe3d5889fad7d84fc0c046 by Victor Stinner in branch '3.5': bpo-39073: validate Address parts to disallow CRLF (#19007) (#20450) https://github.com/python/cpython/commit/f91a0b6df14d6c5133fe3d5889fad7d84fc0c046 

Merged for release in 3.9.0a6, 3.8.4, 3.7.8, 3.6.11, and 3.5.10.