Repository navigation
email: encoded headers lose their quoting when refolded #87720
Description
| BPO | 43554 |
|---|---|
| Nosy | @warsaw, @bitdancer, @maxking |
| Files |
Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.
Show more details
GitHub fields:
assignee = None
closed_at = None
created_at = <Date 2021-03-19.09:45:02.487>
labels = ['type-bug', 'library', '3.9']
title = 'email: encoded headers lose their quoting when refolded'
updated_at = <Date 2021-03-19.18:30:12.248>
user = 'https://bugs.python.org/EmilStyrke'bugs.python.org fields:
activity = <Date 2021-03-19.18:30:12.248>
actor = 'shihai1991'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Library (Lib)']
creation = <Date 2021-03-19.09:45:02.487>
creator = 'Emil.Styrke'
dependencies = []
files = ['49893']
hgrepos = []
issue_num = 43554
keywords = []
message_count = 1.0
messages = ['389061']
nosy_count = 4.0
nosy_names = ['barry', 'r.david.murray', 'Emil.Styrke', 'maxking']
pr_nums = []
priority = 'normal'
resolution = None
stage = None
status = 'open'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue43554'
versions = ['Python 3.9']Linked PRs
- gh-87720 Fix additional header refolding-quoting edge case #134271
- [3.11] gh-87720 Fix additional header refolding-quoting edge case (GH-134271) #159065
- [3.12] gh-87720 Fix additional header refolding-quoting edge case (GH-134271) #159066
- [3.14] gh-87720 Fix additional header refolding-quoting edge case (GH-134271) #159067
- [3.13] gh-87720 Fix additional header refolding-quoting edge case (GH-134271) #159068
- [3.15] gh-87720 Fix additional header refolding-quoting edge case (GH-134271) #159069
Activity
EmilStyrke commentedon Mar 19, 2021
When a header with an encoded (QP or Base64) display_name is refolded, it may lose (some of) its encoding. If it then contains illegal "atext" tokens, an invalid header will result.
For example,
From: =?utf-8?Q?a=2C=20123456789012345678901234567890123456?= <[email protected]>will becomeFrom: a, 123456789012345678901234567890123456 <[email protected]>This contains a comma character which needs to be quoted: correct rendering would beFrom: "a, 123456789012345678901234567890123456" <[email protected]>. Note that this example isn't even folded to multiple lines, since the decoded text is short enough to fit in one line.This can be triggered by
BytesParser(policy=policy.default).parsebytes("From: =?utf-8?Q?a=2C=20123456789012345678901234567890123456?= <[email protected]>").as_bytes(), but the offending code seems to be in or belowemail.policy.EmailPolicy.fold. See attached file for examples with and without folding.brychcy commentedon May 12, 2025
See #121284
medmunds commentedon May 26, 2025
rfc2047 RFC-2047 encoded-word
nessita commentedon Oct 8, 2026
Ping! This still reproduces on 3.14.8 and 3.15.0rc3. An encoded-word display name that decodes to ASCII containing specials is refolded without quoting:
The header parses as a single mailbox but serializes as one that re-parses differently. This behavior has also been (incorrectly) reported to the Django security team; the root cause is here, so fixing it upstream would address those reports at the source.
PR #134271 fixes this and has been approved by @medmunds, who maintains much of Django's email handling and is familiar with this area of the email package. Currently it is awaiting core review but marked stale, I can confirm it does solve the reported issue though.
bitdancer commentedon Oct 8, 2026
Huh. I thought I merged that a while ago. Oops.
I've updated the PR. Can you give me a quick once over on it to make sue I didn't make any stupid typos, and I'll merge it?
gh-87720 Fix additional header refolding-quoting edge case (#134271)
[3.14] gh-87720 Fix additional header refolding-quoting edge case (GH…
medmunds commentedon Oct 9, 2026
Closed by #134271.
[3.15] gh-87720 Fix additional header refolding-quoting edge case (GH…