python / python/cpython

Infinite loop in `email._header_value_parser._fold_mime_parameters` when parameter names are too long

Open
#138,223 12 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

stdlib topic-email type-bug type-security
Dominant language
Python
Stars
77.2k
Forks
35.9k
PR merge metrics
PR metrics pending

Description

Bug report

Bug description:

Tested with 3.6 and 3.13.1

>>> import email.message
>>> message = email.message.EmailMessage()
...
>>> message.add_attachment('Hello World!', filename='hello.txt', params={130 * 'A': 'too long parameter name'})
None
>>> message.defects
[]
>>> message
<email.message.EmailMessage object at 0x7fe78ec74ec0>
>>> message.as_string()

130 characters for a media type parameter name is (a bit) more than https://datatracker.ietf.org/doc/html/rfc6838#section-4.3 allows but I didn't expect it to lead into an infinite loop. I wanted to check if the email module would catch that defect, which apparently it doesn't.

Distribution is openSUSE Leap 15.6, python 3.13.1 was installed from pyenv, 3.6 is from the distribution. The python3.11 binary from the distribution exhibits the same behaviour.

CPython versions tested on:

3.13

Operating systems tested on:

Linux

Linked PRs
  • gh-138226
  • gh-138227
  • gh-138231

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue with email.message.EmailMessage.add_attachment and a 130-character parameter name, then inspect email._header_value_parser._fold_mime_parameters. Check the related issue discussion and linked PRs before proceeding. Done means the input no longer loops indefinitely and regression coverage verifies the resulting behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.