Email Header Injection Protection Bypass

未关闭

#76,787 创建于 2018年1月21日 6 条评论 0 个 reaction 已指派 0 人在 GitHub 查看

还没有人认领这个 Issue。

评估

难度: 5/5
预计耗时: 一周以上
新手友好度: 20/100

Issue 类型: 缺陷
描述清晰度: 需要澄清
活跃度: 停滞
技术栈: python
领域: security

调研方向

首先查看链接的 PythonEmailHeaderInjectionPOC.py proof of concept 以及它所调用的 Python email 库代码。复现已报告的 header injection bypass，然后确定相关的 regression-test 位置；当 bypass 被阻止且 regression test 通过时即完成。

由索引模型根据 Issue 内容生成。

描述

stdlib topic-email type-security

BPO	32606
Nosy	@warsaw, @bitdancer, @csabella, @nitishch, @thedoctorsoup
Files	PythonEmailHeaderInjectionPOC.py: Bypass Proof of Concept

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = None
created_at = <Date 2018-01-21.05:40:52.579>
labels = ['type-security', 'library']
title = 'Email Header Injection Protection Bypass'
updated_at = <Date 2018-09-29.16:09:33.569>
user = 'https://github.com/thedoctorsoup'

bugs.python.org fields:

activity = <Date 2018-09-29.16:09:33.569>
actor = 'cheryl.sabella'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Library (Lib)']
creation = <Date 2018-01-21.05:40:52.579>
creator = 'thedoctorsoup'
dependencies = []
files = ['47396']
hgrepos = []
issue_num = 32606
keywords = []
message_count = 4.0
messages = ['310367', '310904', '310911', '326682']
nosy_count = 5.0
nosy_names = ['barry', 'r.david.murray', 'cheryl.sabella', 'nitishch', 'thedoctorsoup']
pr_nums = []
priority = 'normal'
resolution = None
stage = None
status = 'open'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue32606'
versions = []

主要语言: Python
星标: 77.2k
派生: 36k
平均合并: 1 天 9 小时
30 天内合并 PR: 558