python · basbloemsaat · Jul 14, 2024 · Jul 15, 2024 · Jul 15, 2024 · Jul 16, 2024
@@ -140,11 +140,11 @@ def header_store_parse(self, name, value):
         """
         if hasattr(value, 'name') and value.name.lower() == name.lower():
             return (name, value)
-        if isinstance(value, str) and len(value.splitlines())>1:
-            # XXX this error message isn't quite right when we use splitlines
-            # (see issue 22233), but I'm not sure what should happen here.
+        if (isinstance(value, str) and
+            linesep_splitter.search(self.header_factory(name, value))
+        ):
             raise ValueError("Header values may not contain linefeed "
-                             "or carriage return characters")
+                         "or carriage return characters")
         return (name, self.header_factory(name, value))
 
     def header_fetch_parse(self, name, value):

@@ -398,6 +398,13 @@ def test_header_store_parse_rejects_newlines(self):
                           instance.header_store_parse,
                           'From', 'spam\negg@foo.py')
 
+        self.assertRaises(ValueError,
+                          instance.header_store_parse,
+                              'Subject', 'te\nst')
+
+        self.assertRaises(ValueError,
+                          instance.header_store_parse,
+                          'Subject', 'A 💩 subject=?UTF-8?Q?=0A?=Bcc: injected@example.com')
 
 if __name__ == '__main__':
     unittest.main()
diff --git a/Misc/NEWS.d/next/Library/2024-07-15-21-43-38.gh-issue-121650.A0FkCh.rst b/Misc/NEWS.d/next/Library/2024-07-15-21-43-38.gh-issue-121650.A0FkCh.rst
@@ -0,0 +1,2 @@
+Fixes newlines (and carriage returns) in email headers, both at the end of
+the header, and encoded entities that are resolved to newlines and returns
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		Fixes newlines (and carriage returns) in email headers, both at the end of
basbloemsaat marked this conversation as resolved. Show resolved Hide resolved
		the header, and encoded entities that are resolved to newlines and returns