------------------------------------------------------------
revno: 1327
committer: Mark Sapiro <msap...@value.net>
branch nick: 2.1
timestamp: Sun 2011-11-13 16:47:19 -0800
message:
Strengthened the validation of email addresses.
modified:
Mailman/Utils.py
NEWS
--
lp:mailman/2.1
https://code.launchpad.net/~mailman-coders/mailman/2.1
Your team Mailman Checkins is subscribed to branch lp:mailman/2.1.
To unsubscribe from this branch go to
https://code.launchpad.net/~mailman-coders/mailman/2.1/+edit-subscription
=== modified file 'Mailman/Utils.py'
--- Mailman/Utils.py 2011-09-16 00:21:55 +0000
+++ Mailman/Utils.py 2011-11-14 00:47:19 +0000
@@ -212,10 +212,9 @@
# TBD: what other characters should be disallowed?
-_badchars = re.compile(r'[][()<>|;^,\000-\037\177-\377]')
-# characters in addition to _badchars which are not allowed in
-# unquoted local parts.
-_specials = re.compile(r'[:\\"]')
+_badchars = re.compile(r'[][()<>|:;^,\\"\000-\037\177-\377]')
+# Strictly speaking, some of the above are allowed in quoted local parts, but
+# this can open the door to certain web exploits so we don't allow them.
# Only characters allowed in domain parts.
_valid_domain = re.compile('[-a-z0-9]', re.IGNORECASE)
@@ -232,10 +231,6 @@
raise Errors.MMBadEmailError, s
if len(domain_parts) < 2:
raise Errors.MMBadEmailError, s
- if not (user.startswith('"') and user.endswith('"')):
- # local part is not quoted so it can't contain specials
- if _specials.search(user):
- raise Errors.MMBadEmailError, s
# domain parts may only contain ascii letters, digits and hyphen
for p in domain_parts:
if len(_valid_domain.sub('', p)) > 0:
=== modified file 'NEWS'
--- NEWS 2011-11-13 21:32:08 +0000
+++ NEWS 2011-11-14 00:47:19 +0000
@@ -8,7 +8,7 @@
Security
- - Strengthened the validation of email address domains.
+ - Strengthened the validation of email addresses.
- An XSS vulnerability, CVE-2011-0707, has been fixed.
_______________________________________________
Mailman-checkins mailing list
Mailman-checkins@python.org
Unsubscribe:
http://mail.python.org/mailman/options/mailman-checkins/archive%40jab.org
