[New-bugs-announce] [issue36041] email: folding of quoted string in display_name violates RFC

[Aaryn Tonita]

New submission from Aaryn Tonita <aaryn at startmail.com>:

When using a policy for an EmailMessage that triggers folding (during serialization) of a fairly long display_name in an address field, the folding process removes the quotes from the display name breaking the semantics of the field.

In particular, for a From address's display name like r'anything at anything.com ' + 'a' * MAX_LINE_LEN the folding puts anything at anything.com unquoted immediately after the From: header. For applications that do sender verification inside and then send it to an internal SMTP server that does not perform its own sender verification this could be considered a security issue since it enables sender spoofing. Receiving mail servers might be able to detect the broken header, but experiments show that the mail gets delivered.

Simple demonstration (reproduced in attachment) of issue:

SMTP_POLICY = email.policy.default.clone(linesep='\r\n', max_line_length=72)
address = Address(display_name=r'anything at anything.com ' + 'a' * 72, addr_spec='dev at local.startmail.org')

message = EmailMessage(policy=SMTP_POLICY)
message['From'] = Address(display_name=display_name, addr_spec=addr_spec)

# Trigger folding (via as_string()), then parse it back in.
msg_string = message.as_string()
msg_bytes = msg_string.encode('utf-8')
msg_deserialized = BytesParser(policy=SMTP_POLICY).parsebytes(msg_bytes)

# Verify badness
from_hdr = msg_deserialized['From']
assert from_hdr != str(address)  # But they should be equal...

----------
components: email
files: address_folding_bug.py
messages: 335975
nosy: aaryn.startmail, barry, r.david.murray
priority: normal
severity: normal
status: open
title: email: folding of quoted string in display_name violates RFC
type: behavior
versions: Python 3.5, Python 3.6, Python 3.7
Added file: https://bugs.python.org/file48155/address_folding_bug.py

_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue36041>
_______________________________________