fix(metadata): fold every line boundary when writing headers - #1356
Merged
Conversation
henryiii
force-pushed
the
metadata-header-fold
branch
from
July 31, 2026 19:30
366fe21 to
7b31392
Compare
The header injection only happens on CPython releases without the CVE-2024-6923 fix; patched releases raise HeaderWriteError for a bare carriage return instead. Reword the comment and changelog to say so, add the PR reference, and test the fold through Metadata.as_rfc822() and the exotic-boundary rejection in Summary validation. Assisted-by: ClaudeCode:claude-fable-5
Signed-off-by: Henry Schreiner <henryfs@princeton.edu>
Contributor
|
On newer CPythons, this is an error, it's only on CPythons older than about 2024 (CVE-2024-6923) that this would cause a security issue on. I've pushed an update to clarify the wording and added a test. |
henryiii
approved these changes
Aug 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
header_store_parsefolds\ninto a continuation line, but the email package ends a header line on every boundarystr.splitlinesrecognizes. A value carrying a bare\r,\v,\f,\x1c-\x1e,\x85, U+2028 or U+2029 goes out unfolded, soMetadata.from_raw({"author": "a\rRequires-Dist: evil"}).as_rfc822()writes anauthorheader and then aRequires-Distheader that was never on the metadata object. Values arriving frompyproject.tomlor a JSON payload reach this path directly, since on the parse side those bytes are already line breaks.Folding on the whole boundary set keeps this in one place instead of a per-field check across summary, author, keywords, classifier and project-url, and
\noutput stays byte for byte what it was.Summarystill needs its own check to remain one line, so it now tests the same set.