Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Tests broken by fix for CVE-2023-27043 #233

Open
jackwilsdon opened this issue Oct 17, 2024 · 0 comments
Open

Tests broken by fix for CVE-2023-27043 #233

jackwilsdon opened this issue Oct 17, 2024 · 0 comments

Comments

@jackwilsdon
Copy link

jackwilsdon commented Oct 17, 2024

Running the following:

$ pytest tests/test_message.py -k 'test_unicode_sender_tuple or test_unicode_sender' 

Gives the following 2 test failures:

============================= test session starts ==============================
platform linux -- Python 3.11.10, pytest-8.3.2, pluggy-1.5.0
rootdir: /home/jack/Development/flask-mail
configfile: pyproject.toml
collected 38 items / 36 deselected / 2 selected

tests/test_message.py FF                                                 [100%]

=================================== FAILURES ===================================
__________________________ test_unicode_sender_tuple ___________________________

app = <Flask 'conftest'>, mail = <flask_mail.Mail object at 0x7f2736863b50>

    def test_unicode_sender_tuple(app: Flask, mail: Mail) -> None:
        msg = Message(
            subject="subject",
            sender=("ÄÜÖ → ✓", "[email protected]>"),
            recipients=["[email protected]"],
        )
    
>       assert (
            "From: =?utf-8?b?w4TDnMOWIOKGkiDinJM=?= <[email protected]>" in msg.as_string()
        )
E       assert 'From: =?utf-8?b?w4TDnMOWIOKGkiDinJM=?= <[email protected]>' in 'Content-Type: text/plain; charset="utf-8"\r\nMIME-Version: 1.0\r\nContent-Transfer-Encoding: 7bit\r\nSubject: subject...e.com\r\nDate: Thu, 17 Oct 2024 23:02:26 +0100\r\nMessage-ID: <172920254627.709841.8859146253803791520@frmwrk>\r\n\r\n'
E        +  where 'Content-Type: text/plain; charset="utf-8"\r\nMIME-Version: 1.0\r\nContent-Transfer-Encoding: 7bit\r\nSubject: subject...e.com\r\nDate: Thu, 17 Oct 2024 23:02:26 +0100\r\nMessage-ID: <172920254627.709841.8859146253803791520@frmwrk>\r\n\r\n' = as_string()
E        +    where as_string = <flask_mail.Message object at 0x7f273684d210>.as_string

tests/test_message.py:423: AssertionError
_____________________________ test_unicode_sender ______________________________

app = <Flask 'conftest'>, mail = <flask_mail.Mail object at 0x7f2736860f10>

    def test_unicode_sender(app: Flask, mail: Mail) -> None:
        msg = Message(
            subject="subject",
            sender="ÄÜÖ → ✓ <[email protected]>>",
            recipients=["[email protected]"],
        )
    
>       assert (
            "From: =?utf-8?b?w4TDnMOWIOKGkiDinJM=?= <[email protected]>" in msg.as_string()
        )
E       assert 'From: =?utf-8?b?w4TDnMOWIOKGkiDinJM=?= <[email protected]>' in 'Content-Type: text/plain; charset="utf-8"\r\nMIME-Version: 1.0\r\nContent-Transfer-Encoding: 7bit\r\nSubject: subject...e.com\r\nDate: Thu, 17 Oct 2024 23:02:26 +0100\r\nMessage-ID: <172920254629.709841.4673263625146708117@frmwrk>\r\n\r\n'
E        +  where 'Content-Type: text/plain; charset="utf-8"\r\nMIME-Version: 1.0\r\nContent-Transfer-Encoding: 7bit\r\nSubject: subject...e.com\r\nDate: Thu, 17 Oct 2024 23:02:26 +0100\r\nMessage-ID: <172920254629.709841.4673263625146708117@frmwrk>\r\n\r\n' = as_string()
E        +    where as_string = <flask_mail.Message object at 0x7f2736861e90>.as_string

tests/test_message.py:435: AssertionError
=========================== short test summary info ============================
FAILED tests/test_message.py::test_unicode_sender_tuple - assert 'From: =?utf...
FAILED tests/test_message.py::test_unicode_sender - assert 'From: =?utf-8?b?w...
======================= 2 failed, 36 deselected in 0.04s =======================

This is caused by email.utils.parseaddr returning an empty tuple for the emails used in those tests:

$ python3 -c 'import email.utils; print(email.utils.parseaddr("ÄÜÖ → ✓ [email protected]>"))'
('', '')

This wasn't the case prior to the CVE fix released in the below Python versions.

Environment:

  • Python version: 3.9.20 / 3.10.15 / 3.11.10 / 3.12.6 / 3.13.0
  • Flask-Mail version: 0.10.0
  • Flask version: 3.0.3
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

1 participant