You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
59 lines
2.0 KiB
59 lines
2.0 KiB
|
|
# HG changeset patch |
|
# User R David Murray <rdmurray@bitdance.com> |
|
# Date 1388775562 18000 |
|
# Node ID dd906f4ab9237020a7a275c2d361fa288e553481 |
|
# Parent 69b5f692455306c98aa27ecea17e6290787ebd3f |
|
closes 16039: CVE-2013-1752: limit line length in imaplib readline calls. |
|
|
|
diff --git a/Lib/imaplib.py b/Lib/imaplib.py |
|
--- a/Lib/imaplib.py |
|
+++ b/Lib/imaplib.py |
|
@@ -35,6 +35,15 @@ IMAP4_PORT = 143 |
|
IMAP4_SSL_PORT = 993 |
|
AllowedVersions = ('IMAP4REV1', 'IMAP4') # Most recent first |
|
|
|
+# Maximal line length when calling readline(). This is to prevent |
|
+# reading arbitrary length lines. RFC 3501 and 2060 (IMAP 4rev1) |
|
+# don't specify a line length. RFC 2683 however suggests limiting client |
|
+# command lines to 1000 octets and server command lines to 8000 octets. |
|
+# We have selected 10000 for some extra margin and since that is supposedly |
|
+# also what UW and Panda IMAP does. |
|
+_MAXLINE = 10000 |
|
+ |
|
+ |
|
# Commands |
|
|
|
Commands = { |
|
@@ -237,7 +246,10 @@ class IMAP4: |
|
|
|
def readline(self): |
|
"""Read line from remote.""" |
|
- return self.file.readline() |
|
+ line = self.file.readline(_MAXLINE + 1) |
|
+ if len(line) > _MAXLINE: |
|
+ raise self.error("got more than %d bytes" % _MAXLINE) |
|
+ return line |
|
|
|
|
|
def send(self, data): |
|
diff --git a/Lib/test/test_imaplib.py b/Lib/test/test_imaplib.py |
|
--- a/Lib/test/test_imaplib.py |
|
+++ b/Lib/test/test_imaplib.py |
|
@@ -165,6 +165,16 @@ class BaseThreadedNetworkedTests(unittes |
|
self.imap_class, *server.server_address) |
|
|
|
|
|
+ def test_linetoolong(self): |
|
+ class TooLongHandler(SimpleIMAPHandler): |
|
+ def handle(self): |
|
+ # Send a very long response line |
|
+ self.wfile.write('* OK ' + imaplib._MAXLINE*'x' + '\r\n') |
|
+ |
|
+ with self.reaped_server(TooLongHandler) as server: |
|
+ self.assertRaises(imaplib.IMAP4.error, |
|
+ self.imap_class, *server.server_address) |
|
+ |
|
class ThreadedNetworkedTests(BaseThreadedNetworkedTests): |
|
|
|
server_class = SocketServer.TCPServer
|
|
|