Skip to content

gh-87112: Ensure that only digits convertible to integers are accepted as section number in MIME header parameter #136877

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 9 commits into
base: main
Choose a base branch
from
Prev Previous commit
Next Next commit
Comments from PR review, improve phrasing
  • Loading branch information
matthieucan committed Jul 20, 2025
commit d2d59eee08a60353f622c8de670ef250ea01ef71
7 changes: 3 additions & 4 deletions Lib/email/_header_value_parser.py
Original file line number Diff line number Diff line change
Expand Up @@ -2404,13 +2404,12 @@ def get_section(value):
value))
section.append(ValueTerminal('*', 'section-marker'))
value = value[1:]
# We don't use str.isdigit because only 0-9 are accepted, not super-script
# and other types of digits.
if not value or not '0' <= value[0] <= '9':
# We don't use str.isdigit because only ASCII digits are allowed.
if not value or not ('0' <= value[0] <= '9'):
raise errors.HeaderParseError("Expected section number but "
"found {}".format(value))
digits = ''
while value and '0' <= value[0] <= '9':
while value and ('0' <= value[0] <= '9'):
digits += value[0]
value = value[1:]
if digits[0] == '0' and digits != '0':
Expand Down
3 changes: 1 addition & 2 deletions Lib/test/test_email/test__header_value_parser.py
Original file line number Diff line number Diff line change
Expand Up @@ -2983,8 +2983,7 @@ def mime_parameters_as_value(self,
[('r', '"')],
[errors.InvalidHeaderDefect]*2),

# gh-87112: Unicode super-script digits (and others) are not allowed
# as section numbers.
# gh-87112: Only ASCII digits can be section numbers.
'non_allowed_digits': (
'foo*0=bar; foo*²=baz',
' foo="bar"',
Expand Down
Loading
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy