Skip to content

gh-87112: Ensure that only digits convertible to integers are accepted as section number in MIME header parameter #136877

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 9 commits into
base: main
Choose a base branch
from
+33 −2
Open

gh-87112: Ensure that only digits convertible to integers are accepted as section number in MIME header parameter #136877

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
ff4ca5c
Only allow 0-9 digits in MIME parameter section numbers
matthieucan Jul 20, 2025
656b6fb
Use gh bug nubmer
matthieucan Jul 20, 2025
75636a5
Add news entry
matthieucan Jul 20, 2025
b15c404
Comments from PR review, remove inner function
matthieucan Jul 20, 2025
7cba42f
Rephrase News entry
matthieucan Jul 20, 2025
d2d59ee
Comments from PR review, improve phrasing
matthieucan Jul 20, 2025
54bbbb7
Use separate function
matthieucan Jul 20, 2025
f12e424
Accept digits that are convertible to int for backwards compatibility
matthieucan Jul 27, 2025
b364339
Update news message
matthieucan Jul 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions Lib/email/_header_value_parser.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2404,11 +2404,13 @@ def get_section(value):
value))
section.append(ValueTerminal('*', 'section-marker'))
value = value[1:]
if not value or not value[0].isdigit():
# We don't use str.isdigit because only 0-9 are accepted, not super-script
# and other types of digits.
if not value or not '0' <= value[0] <= '9':
raise errors.HeaderParseError("Expected section number but "
"found {}".format(value))
digits = ''
while value and value[0].isdigit():
while value and '0' <= value[0] <= '9':
Copy link
Member

@picnixz picnixz Jul 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
while value and '0' <= value[0] <= '9':
while value and ('0' <= value[0] <= '9'):

It will a bit clearer. Or you can still use a separate function to make it even cleareer. The bottleneck won't be the function call IMO.

Copy link
Contributor Author

@matthieucan matthieucan Jul 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I did that, but not the separate function. It was my understanding that @StanFromIreland was leaning towards not having an inner function

Copy link
Member

@StanFromIreland StanFromIreland Jul 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is fine, I was against the function to check if it is in a dictionary.

Copy link
Contributor Author

@matthieucan matthieucan Jul 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you! Just moved it to a separate function for extra-clarity

digits += value[0]
value = value[1:]
if digits[0] == '0' and digits != '0':
Expand Down
9 changes: 9 additions & 0 deletions Lib/test/test_email/test__header_value_parser.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2982,6 +2982,15 @@ def mime_parameters_as_value(self,
'r*=\'a\'"',
[('r', '"')],
[errors.InvalidHeaderDefect]*2),

# gh-87112: Unicode super-script digits (and others) are not allowed
# as section numbers.
'non_allowed_digits': (
'foo*0=bar; foo*²=baz',
' foo="bar"',
'foo*0=bar; foo*²=baz',
[('foo', 'bar')],
[errors.InvalidHeaderDefect]),
}

@parameterize
Expand Down
2 changes: 2 additions & 0 deletions Misc/NEWS.d/next/Library/2025-07-20-17-57-39.gh-issue-87112.sKU2V8.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
Ensure that only ASCII digits are accepted as section number in MIME header
parameter.
Loading