|
 |
925e6b |
|
|
|
925e6b |
# HG changeset patch
|
|
|
925e6b |
# User Benjamin Peterson <benjamin@python.org>
|
|
|
925e6b |
# Date 1417827758 18000
|
|
|
925e6b |
# Node ID 339f877cca115c1901f5dd93d7bc066031d2a669
|
|
|
925e6b |
# Parent 54af094087953f4997a4ead63e949d845c4b4412
|
|
|
925e6b |
in poplib, limit maximum line length that we read from the network (closes #16041)
|
|
|
925e6b |
|
|
|
925e6b |
Patch from Berker Peksag.
|
|
|
925e6b |
|
|
|
925e6b |
diff --git a/Lib/poplib.py b/Lib/poplib.py
|
|
|
925e6b |
--- a/Lib/poplib.py
|
|
|
925e6b |
+++ b/Lib/poplib.py
|
|
|
925e6b |
@@ -32,6 +32,12 @@ CR = '\r'
|
|
|
925e6b |
LF = '\n'
|
|
|
925e6b |
CRLF = CR+LF
|
|
|
925e6b |
|
|
|
925e6b |
+# maximal line length when calling readline(). This is to prevent
|
|
|
925e6b |
+# reading arbitrary length lines. RFC 1939 limits POP3 line length to
|
|
|
925e6b |
+# 512 characters, including CRLF. We have selected 2048 just to be on
|
|
|
925e6b |
+# the safe side.
|
|
|
925e6b |
+_MAXLINE = 2048
|
|
|
925e6b |
+
|
|
|
925e6b |
|
|
|
925e6b |
class POP3:
|
|
|
925e6b |
|
|
|
925e6b |
@@ -103,7 +109,9 @@ class POP3:
|
|
|
925e6b |
# Raise error_proto('-ERR EOF') if the connection is closed.
|
|
|
925e6b |
|
|
|
925e6b |
def _getline(self):
|
|
|
925e6b |
- line = self.file.readline()
|
|
|
925e6b |
+ line = self.file.readline(_MAXLINE + 1)
|
|
|
925e6b |
+ if len(line) > _MAXLINE:
|
|
|
925e6b |
+ raise error_proto('line too long')
|
|
|
925e6b |
if self._debugging > 1: print '*get*', repr(line)
|
|
|
925e6b |
if not line: raise error_proto('-ERR EOF')
|
|
|
925e6b |
octets = len(line)
|
|
|
925e6b |
@@ -365,6 +373,8 @@ else:
|
|
|
925e6b |
match = renewline.match(self.buffer)
|
|
|
925e6b |
while not match:
|
|
|
925e6b |
self._fillBuffer()
|
|
|
925e6b |
+ if len(self.buffer) > _MAXLINE:
|
|
|
925e6b |
+ raise error_proto('line too long')
|
|
|
925e6b |
match = renewline.match(self.buffer)
|
|
|
925e6b |
line = match.group(0)
|
|
|
925e6b |
self.buffer = renewline.sub('' ,self.buffer, 1)
|
|
|
925e6b |
diff --git a/Lib/test/test_poplib.py b/Lib/test/test_poplib.py
|
|
|
925e6b |
--- a/Lib/test/test_poplib.py
|
|
|
925e6b |
+++ b/Lib/test/test_poplib.py
|
|
|
925e6b |
@@ -198,6 +198,10 @@ class TestPOP3Class(TestCase):
|
|
|
925e6b |
113)
|
|
|
925e6b |
self.assertEqual(self.client.retr('foo'), expected)
|
|
|
925e6b |
|
|
|
925e6b |
+ def test_too_long_lines(self):
|
|
|
925e6b |
+ self.assertRaises(poplib.error_proto, self.client._shortcmd,
|
|
|
925e6b |
+ 'echo +%s' % ((poplib._MAXLINE + 10) * 'a'))
|
|
|
925e6b |
+
|
|
|
925e6b |
def test_dele(self):
|
|
|
925e6b |
self.assertOK(self.client.dele('foo'))
|
|
|
925e6b |
|