gh-121284: Fix email address header folding with parsed encoded-word

Lib/email/_header_value_parser.py

@@ -2829,6 +2829,13 @@ def _refold_parse_tree(parse_tree, *, policy):
             _fold_mime_parameters(part, lines, maxlen, encoding)
             continue
 
+        allow_refolding_subparts = True
+        if part.token_type == 'encoded-word':
+            # A parsed encoded-word containing specials must remain encoded,
+            # to keep specials from sneaking into a structured header unquoted.
+            # (The encoded-word can be split for folding.)
+            allow_refolding_subparts = SPECIALSNL.isdisjoint(tstr)
+
         if want_encoding and not wrap_as_ew_blocked:
             if not part.as_ew_allowed:
                 want_encoding = False
@@ -2848,7 +2855,7 @@ def _refold_parse_tree(parse_tree, *, policy):
                 # want it on a line by itself even if it fits, or it
                 # doesn't fit on a line by itself.  Either way, fall through
                 # to unpacking the subparts and wrapping them.
-            if not hasattr(part, 'encode'):
+            if allow_refolding_subparts and not hasattr(part, 'encode'):
                 # It's not a Terminal, do each piece individually.
                 parts = list(part) + parts
                 want_encoding = False
@@ -2902,7 +2909,7 @@ def _refold_parse_tree(parse_tree, *, policy):
                 leading_whitespace = ''.join(whitespace_accumulator)
                 last_ew = None
                 continue
-        if not hasattr(part, 'encode'):
+        if allow_refolding_subparts and not hasattr(part, 'encode'):
             # It's not a terminal, try folding the subparts.
             newparts = list(part)
             if not part.as_ew_allowed:

Lib/test/test_email/test__header_value_parser.py

@@ -3076,6 +3076,31 @@ def test_address_list_with_unicode_names_in_quotes(self):
             '=?utf-8?q?H=C3=BCbsch?= Kaktus <[email protected]>,\n'
                 ' =?utf-8?q?bei=C3=9Ft_bei=C3=9Ft?= <[email protected]>\n')
 
+    def test_address_list_with_specials_in_encoded_word(self):
+        # An encoded-word parsed from a structured header must remain
+        # encoded when it contains specials. Regression for gh-121284.
+        policy = self.policy.clone(max_line_length=40)
+        cases = [
+            # (to, folded)
+            ('=?utf-8?q?A_v=C3=A9ry_long_name_with=2C_comma?= <[email protected]>',
+             '=?utf-8?q?A_v=C3=A9ry_long_name_with?=\n'
+             ' =?utf-8?q?=2C_comma?= <[email protected]>\n'),
+            ('=?utf-8?q?This_long_name_does_not_need_encoded=2Dword?= <[email protected]>',
+             'This long name does not need\n'
+             ' encoded-word <[email protected]>\n'),
+            ('"A véry long name with, comma" <[email protected]>',
+             # (This isn't the best fold point, but it's not invalid.)
+             'A =?utf-8?q?v=C3=A9ry_long_name_with?=\n'
+             ' =?utf-8?q?=2C?= comma <[email protected]>\n'),
+            ('"A véry long name containing a, comma" <[email protected]>',
+             'A =?utf-8?q?v=C3=A9ry?= long name\n'
+             ' containing =?utf-8?q?a=2C?= comma\n'
+             ' <[email protected]>\n'),
+        ]
+        for (to, folded) in cases:
+            with self.subTest(to=to):
+                self._test(parser.get_address_list(to)[0], folded, policy=policy)
+
     def test_address_list_with_list_separator_after_fold(self):
         a = 'x' * 66 + '@example.com'
         to = f'{a}, "Hübsch Kaktus" <[email protected]>'

Misc/NEWS.d/next/Security/2024-08-06-12-27-34.gh-issue-121284.8rwPxe.rst

@@ -0,0 +1,7 @@
+Fix bug in the folding of rfc2047 encoded-words when flattening an email message
+using a modern email policy. Previously when an encoded-word was too long
+for a line, it would be decoded, split across lines, and re-encoded. But commas
+and other special characters in the original text could be left unencoded and
+unquoted. This could theoretically be used to spoof header lines using
+a carefully constructed encoded-word if the resulting rendered email was
+transmitted or re-parsed.