bpo-16039: CVE-2013-1752: Limit imaplib.IMAP4_SSL.readline() (GH-11120) · python/cpython@16d6320

3 files changed

lines changed

Original file line numberDiff line numberDiff line change

@@ -1182,16 +1182,6 @@ def open(self, host = '', port = IMAP4_SSL_PORT):

11821182

self.file = self.sslobj.makefile('rb')

11831183
11841184
1185-

def read(self, size):

1186-

"""Read 'size' bytes from remote."""

1187-

return self.file.read(size)

1188-
1189-
1190-

def readline(self):

1191-

"""Read line from remote."""

1192-

return self.file.readline()

1193-
1194-
11951185

def send(self, data):

11961186

"""Send data to remote."""

11971187

bytes = len(data)

Original file line numberDiff line numberDiff line change

@@ -166,14 +166,18 @@ def handle(self):

166166
167167
168168

def test_linetoolong(self):

169+

maxline = 10

170+
169171

class TooLongHandler(SimpleIMAPHandler):

170172

def handle(self):

171173

# Send a very long response line

172-

self.wfile.write('* OK ' + imaplib._MAXLINE*'x' + '\r\n')

174+

self.wfile.write('* OK ' + maxline * 'x' + '\r\n')

173175
174-

with self.reaped_server(TooLongHandler) as server:

175-

self.assertRaises(imaplib.IMAP4.error,

176-

self.imap_class, *server.server_address)

176+

with self.reaped_server(TooLongHandler) as server, \

177+

support.swap_attr(imaplib, '_MAXLINE', maxline):

178+

with self.assertRaisesRegexp(imaplib.IMAP4.error,

179+

'got more than 10 bytes'):

180+

self.imap_class(*server.server_address)

177181
178182

class ThreadedNetworkedTests(BaseThreadedNetworkedTests):

179183

@@ -187,9 +191,6 @@ class ThreadedNetworkedTestsSSL(BaseThreadedNetworkedTests):

187191

server_class = SecureTCPServer

188192

imap_class = IMAP4_SSL

189193
190-

def test_linetoolong(self):

191-

raise unittest.SkipTest("test is not reliable on 2.7; see issue 20118")

192-
193194
194195

class RemoteIMAPTest(unittest.TestCase):

195196

host = 'cyrus.andrew.cmu.edu'

Original file line numberDiff line numberDiff line change

@@ -0,0 +1,2 @@

1+

CVE-2013-1752: Change use of ``readline()`` in :class:`imaplib.IMAP4_SSL` to

2+

limit line length.