1. 09 Jan, 2011 1 commit
    • R. David Murray's avatar
      #5871: protect against header injection attacks. · 5b2d9ddf
      R. David Murray authored
      This makes Header.encode throw a HeaderParseError if it winds up
      formatting a header such that a continuation line has no leading
      whitespace and looks like a header.  Since Header accepts values
      containing newlines and preserves them (and this is by design), without
      this fix any program that took user input (say, a subject in a web form)
      and passed it to the email package as a header was vulnerable to header
      injection attacks.  (As far as we know this has never been exploited.)
      
      Thanks to Jakub Wilk for reporting this vulnerability.
      5b2d9ddf
  2. 08 Jan, 2011 22 commits
  3. 07 Jan, 2011 17 commits