-
-
Notifications
You must be signed in to change notification settings - Fork 32.4k
gh-87112: Ensure that only ASCII digits are accepted as section number in MIME header parameter #136877
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
Lib/email/_header_value_parser.py
Outdated
raise errors.HeaderParseError("Expected section number but " | ||
"found {}".format(value)) | ||
digits = '' | ||
while value and value[0].isdigit(): | ||
while value and '0' <= value[0] <= '9': |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
while value and '0' <= value[0] <= '9': | |
while value and ('0' <= value[0] <= '9'): |
It will a bit clearer. Or you can still use a separate function to make it even cleareer. The bottleneck won't be the function call IMO.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I did that, but not the separate function. It was my understanding that @StanFromIreland was leaning towards not having an inner function
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is fine, I was against the function to check if it is in a dictionary.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you! Just moved it to a separate function for extra-clarity
With those changes, the MIME parameter parser discards parameters with an invalid section number that uses a non 0-9 digit such as super-script "²" or "𐩃" (Kharosthi number).
Before:
After: