https://github.com/python/cpython/commit/a42168d316f0c9a4fc5658dab87682dc190... commit: a42168d316f0c9a4fc5658dab87682dc19054efb branch: main author: Kanishk Pachauri <itskanishkp.py@gmail.com> committer: ericvsmith <ericvsmith@users.noreply.github.com> date: 2025-03-02T08:05:40-05:00 summary: gh-130637: Add validation for numeric response data in `stat()` method (#130646) Co-authored-by: Eric V. Smith <ericvsmith@users.noreply.github.com> files: A Misc/NEWS.d/next/Library/2025-03-01-02-19-28.gh-issue-130637.swet54w4rs.rst M Lib/poplib.py M Lib/test/test_poplib.py diff --git a/Lib/poplib.py b/Lib/poplib.py index beb93a0d57cf93..4469bff44b4c45 100644 --- a/Lib/poplib.py +++ b/Lib/poplib.py @@ -226,8 +226,19 @@ def stat(self): retval = self._shortcmd('STAT') rets = retval.split() if self._debugging: print('*stat*', repr(rets)) - numMessages = int(rets[1]) - sizeMessages = int(rets[2]) + + # Check if the response has enough elements + # RFC 1939 requires at least 3 elements (+OK, message count, mailbox size) + # but allows additional data after the required fields + if len(rets) < 3: + raise error_proto("Invalid STAT response format") + + try: + numMessages = int(rets[1]) + sizeMessages = int(rets[2]) + except ValueError: + raise error_proto("Invalid STAT response data: non-numeric values") + return (numMessages, sizeMessages) diff --git a/Lib/test/test_poplib.py b/Lib/test/test_poplib.py index 869f9431b928bb..f1ebbeafe0cfb4 100644 --- a/Lib/test/test_poplib.py +++ b/Lib/test/test_poplib.py @@ -289,6 +289,37 @@ def test_pass_(self): def test_stat(self): self.assertEqual(self.client.stat(), (10, 100)) + original_shortcmd = self.client._shortcmd + def mock_shortcmd_invalid_format(cmd): + if cmd == 'STAT': + return b'+OK' + return original_shortcmd(cmd) + + self.client._shortcmd = mock_shortcmd_invalid_format + with self.assertRaises(poplib.error_proto): + self.client.stat() + + def mock_shortcmd_invalid_data(cmd): + if cmd == 'STAT': + return b'+OK abc def' + return original_shortcmd(cmd) + + self.client._shortcmd = mock_shortcmd_invalid_data + with self.assertRaises(poplib.error_proto): + self.client.stat() + + def mock_shortcmd_extra_fields(cmd): + if cmd == 'STAT': + return b'+OK 1 2 3 4 5' + return original_shortcmd(cmd) + + self.client._shortcmd = mock_shortcmd_extra_fields + + result = self.client.stat() + self.assertEqual(result, (1, 2)) + + self.client._shortcmd = original_shortcmd + def test_list(self): self.assertEqual(self.client.list()[1:], ([b'1 1', b'2 2', b'3 3', b'4 4', b'5 5'], diff --git a/Misc/NEWS.d/next/Library/2025-03-01-02-19-28.gh-issue-130637.swet54w4rs.rst b/Misc/NEWS.d/next/Library/2025-03-01-02-19-28.gh-issue-130637.swet54w4rs.rst new file mode 100644 index 00000000000000..83cd6c63c35215 --- /dev/null +++ b/Misc/NEWS.d/next/Library/2025-03-01-02-19-28.gh-issue-130637.swet54w4rs.rst @@ -0,0 +1 @@ +Add validation for numeric response data in poplib.POP3.stat() method