You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
61 lines
2.0 KiB
61 lines
2.0 KiB
4 years ago
|
|
||
|
|
# HG changeset patch
|
||
|
|
# User Benjamin Peterson <benjamin@python.org>
|
||
|
|
# Date 1417827758 18000
|
||
|
|
# Node ID 339f877cca115c1901f5dd93d7bc066031d2a669
|
||
|
|
# Parent 54af094087953f4997a4ead63e949d845c4b4412
|
||
|
|
in poplib, limit maximum line length that we read from the network (closes #16041)
|
||
|
|
|
||
|
|
Patch from Berker Peksag.
|
||
|
|
|
||
|
|
diff --git a/Lib/poplib.py b/Lib/poplib.py
|
||
|
|
--- a/Lib/poplib.py
|
||
|
|
+++ b/Lib/poplib.py
|
||
|
|
@@ -32,6 +32,12 @@ CR = '\r'
|
||
|
|
LF = '\n'
|
||
|
|
CRLF = CR+LF
|
||
|
|
|
||
|
|
+# maximal line length when calling readline(). This is to prevent
|
||
|
|
+# reading arbitrary length lines. RFC 1939 limits POP3 line length to
|
||
|
|
+# 512 characters, including CRLF. We have selected 2048 just to be on
|
||
|
|
+# the safe side.
|
||
|
|
+_MAXLINE = 2048
|
||
|
|
+
|
||
|
|
|
||
|
|
class POP3:
|
||
|
|
|
||
|
|
@@ -103,7 +109,9 @@ class POP3:
|
||
|
|
# Raise error_proto('-ERR EOF') if the connection is closed.
|
||
|
|
|
||
|
|
def _getline(self):
|
||
|
|
- line = self.file.readline()
|
||
|
|
+ line = self.file.readline(_MAXLINE + 1)
|
||
|
|
+ if len(line) > _MAXLINE:
|
||
|
|
+ raise error_proto('line too long')
|
||
|
|
if self._debugging > 1: print '*get*', repr(line)
|
||
|
|
if not line: raise error_proto('-ERR EOF')
|
||
|
|
octets = len(line)
|
||
|
|
@@ -365,6 +373,8 @@ else:
|
||
|
|
match = renewline.match(self.buffer)
|
||
|
|
while not match:
|
||
|
|
self._fillBuffer()
|
||
|
|
+ if len(self.buffer) > _MAXLINE:
|
||
|
|
+ raise error_proto('line too long')
|
||
|
|
match = renewline.match(self.buffer)
|
||
|
|
line = match.group(0)
|
||
|
|
self.buffer = renewline.sub('' ,self.buffer, 1)
|
||
|
|
diff --git a/Lib/test/test_poplib.py b/Lib/test/test_poplib.py
|
||
|
|
--- a/Lib/test/test_poplib.py
|
||
|
|
+++ b/Lib/test/test_poplib.py
|
||
|
|
@@ -198,6 +198,10 @@ class TestPOP3Class(TestCase):
|
||
|
|
113)
|
||
|
|
self.assertEqual(self.client.retr('foo'), expected)
|
||
|
|
|
||
|
|
+ def test_too_long_lines(self):
|
||
|
|
+ self.assertRaises(poplib.error_proto, self.client._shortcmd,
|
||
|
|
+ 'echo +%s' % ((poplib._MAXLINE + 10) * 'a'))
|
||
|
|
+
|
||
|
|
def test_dele(self):
|
||
|
|
self.assertOK(self.client.dele('foo'))
|
||
|
|
|