Issue 43554: email: encoded headers lose their quoting when refolded

➜

This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

This issue has been migrated to GitHub: https://github.com/python/cpython/issues/87720

classification

Title:	email: encoded headers lose their quoting when refolded
Type:	behavior	Stage:
Components:	Library (Lib)	Versions:	Python 3.9

process

Status:	open	Resolution:
Dependencies:		Superseder:
Assigned To:		Nosy List:	Emil.Styrke, barry, maxking, r.david.murray
Priority:	normal	Keywords:

Created on 2021-03-19 09:45 by Emil.Styrke, last changed 2022-04-11 14:59 by admin.

Files
File name	Uploaded	Description	Edit
test_folding_bug.py	Emil.Styrke, 2021-03-19 09:45	unittest displaying the issue

Messages (1)
msg389061 - (view)	Author: Emil Styrke (Emil.Styrke)	Date: 2021-03-19 09:45
When a header with an encoded (QP or Base64) display_name is refolded, it may lose (some of) its encoding. If it then contains illegal "atext" tokens, an invalid header will result. For example, `From: =?utf-8?Q?a=2C=20123456789012345678901234567890123456?= <[email protected]>` will become `From: a, 123456789012345678901234567890123456 <[email protected]>` This contains a comma character which needs to be quoted: correct rendering would be `From: "a, 123456789012345678901234567890123456" <[email protected]>`. Note that this example isn't even folded to multiple lines, since the decoded text is short enough to fit in one line. This can be triggered by `BytesParser(policy=policy.default).parsebytes("From: =?utf-8?Q?a=2C=20123456789012345678901234567890123456?= <[email protected]>").as_bytes()`, but the offending code seems to be in or below `email.policy.EmailPolicy.fold`. See attached file for examples with and without folding.

msg389061 - (view)

Author: Emil Styrke (Emil.Styrke)

Date: 2021-03-19 09:45

When a header with an encoded (QP or Base64) display_name is refolded, it may lose (some of) its encoding.  If it then contains illegal "atext" tokens, an invalid header will result.

For example, `From: =?utf-8?Q?a=2C=20123456789012345678901234567890123456?= <[email protected]>` will become `From: a, 123456789012345678901234567890123456 <[email protected]>`  This contains a comma character which needs to be quoted: correct rendering would be `From: "a, 123456789012345678901234567890123456" <[email protected]>`. Note that this example isn't even folded to multiple lines, since the decoded text is short enough to fit in one line.

This can be triggered by `BytesParser(policy=policy.default).parsebytes("From: =?utf-8?Q?a=2C=20123456789012345678901234567890123456?= <[email protected]>").as_bytes()`, but the offending code seems to be in or below `email.policy.EmailPolicy.fold`.  See attached file for examples with and without folding.

History
Date	User	Action	Args
2022-04-11 14:59:43	admin	set	github: 87720
2021-03-19 18:30:12	shihai1991	set	nosy: + barry, r.david.murray, maxking
2021-03-19 09:45:02	Emil.Styrke	create