[3.8] bpo-34155: Dont parse domains containing @ (GH-13079)

Lib/email/_header_value_parser.py

@@ -1566,6 +1566,8 @@ def get_domain(value):
  token, value = get_dot_atom(value)
  except errors.HeaderParseError:
  token, value = get_atom(value)
+ if value and value[0] == '@':
+ raise errors.HeaderParseError('Invalid Domain')
  if leader is not None:
  token[:0] = [leader]
  domain.append(token)

Lib/email/_parseaddr.py

@@ -379,7 +379,12 @@ def getaddrspec(self):
 aslist.append('@')
 self.pos+=1
 self.gotonext()
-returnEMPTYSTRING.join(aslist) +self.getdomain()
+domain=self.getdomain()
+ifnotdomain:
+# Invalid domain, return an empty address instead of returning a
+# local part to denote failed parsing.
+returnEMPTYSTRING
+returnEMPTYSTRING.join(aslist) +domain
 
 defgetdomain(self):
 """Get the complete domain name from an address."""
@@ -394,6 +399,10 @@ def getdomain(self):
 elifself.field[self.pos] =='.':
 self.pos+=1
 sdlist.append('.')
+elifself.field[self.pos] =='@':
+# bpo-34155: Don't parse domains with two `@` like
+# `[email protected]@important.com`.
+returnEMPTYSTRING
 elifself.field[self.pos] inself.atomends:
 break
 else:

Lib/test/test_email/test__header_value_parser.py

@@ -1428,6 +1428,16 @@ def test_get_addr_spec_dot_atom(self):
  self.assertEqual(addr_spec.domain, 'example.com')
  self.assertEqual(addr_spec.addr_spec, '[email protected]')
 
+ def test_get_addr_spec_multiple_domains(self):
+ with self.assertRaises(errors.HeaderParseError):
+ parser.get_addr_spec('[email protected]@example.com')
+
+ with self.assertRaises(errors.HeaderParseError):
+ parser.get_addr_spec('star@[email protected]')
+
+ with self.assertRaises(errors.HeaderParseError):
+ parser.get_addr_spec('[email protected]@example.com')
+
  # get_obs_route
 
  def test_get_obs_route_simple(self):

Lib/test/test_email/test_email.py

@@ -3041,6 +3041,20 @@ def test_parseaddr_empty(self):
 self.assertEqual(utils.parseaddr('<>'), ('', ''))
 self.assertEqual(utils.formataddr(utils.parseaddr('<>')), '')
 
+deftest_parseaddr_multiple_domains(self):
+self.assertEqual(
+utils.parseaddr('a@b@c'),
+ ('', '')
+ )
+self.assertEqual(
+utils.parseaddr('[email protected]@c'),
+ ('', '')
+ )
+self.assertEqual(
+utils.parseaddr('[email protected]@c'),
+ ('', '')
+ )
+
 deftest_noquote_dump(self):
 self.assertEqual(
 utils.formataddr(('A Silly Person', '[email protected]')),

Misc/NEWS.d/next/Security/2019-05-04-13-33-37.bpo-34155.MJll68.rst

@@ -0,0 +1 @@
+Fix parsing of invalid email addresses with more than one ``@`` (e.g. a@[email protected].) to not return the part before 2nd ``@`` as valid email address. Patch by maxking & jpic.