------------------------------------------------------------
revno: 1180
committer: Mark Sapiro <msap...@value.net>
branch nick: 2.2
timestamp: Thu 2011-09-15 17:22:52 -0700
message:
Strengthened the validation of email address domains.
modified:
Mailman/Utils.py
NEWS
--
lp:mailman/2.2
https://code.launchpad.net/~mailman-coders/mailman/2.2
Your team Mailman Checkins is subscribed to branch lp:mailman/2.2.
To unsubscribe from this branch go to
https://code.launchpad.net/~mailman-coders/mailman/2.2/+edit-subscription
=== modified file 'Mailman/Utils.py'
--- Mailman/Utils.py 2011-05-01 16:19:46 +0000
+++ Mailman/Utils.py 2011-09-16 00:22:52 +0000
@@ -217,6 +217,8 @@
# characters in addition to _badchars which are not allowed in
# unquoted local parts.
_specials = re.compile(r'[:\\"]')
+# Only characters allowed in domain parts.
+_valid_domain = re.compile('[-a-z0-9]', re.IGNORECASE)
def ValidateEmail(s):
"""Verify that an email address isn't grossly evil."""
@@ -235,6 +237,10 @@
# local part is not quoted so it can't contain specials
if _specials.search(user):
raise Errors.MMBadEmailError, s
+ # domain parts may only contain ascii letters, digits and hyphen
+ for p in domain_parts:
+ if len(_valid_domain.sub('', p)) > 0:
+ raise Errors.MMHostileAddress, s
=== modified file 'NEWS'
--- NEWS 2011-09-16 00:14:29 +0000
+++ NEWS 2011-09-16 00:22:52 +0000
@@ -78,6 +78,8 @@
Security
+ - Strengthened the validation of email address domains.
+
- An XSS vulnerability, CVE-2011-0707, has been fixed.
New Features
_______________________________________________
Mailman-checkins mailing list
Mailman-checkins@python.org
Unsubscribe:
http://mail.python.org/mailman/options/mailman-checkins/archive%40jab.org
