bpo-39073: validate Address parts to disallow CRLF

Lib/email/headerregistry.py

@@ -48,6 +48,12 @@ def __init__(self, display_name='', username='', domain='', addr_spec=None):
                 raise a_s.all_defects[0]
             username = a_s.local_part
             domain = a_s.domain
+        else:
+            self._validate_part(username)
+            self._validate_part(domain)
+
+        self._validate_part(display_name)
+
         self._display_name = display_name
         self._username = username
         self._domain = domain
@@ -99,6 +105,10 @@ def __eq__(self, other):
                 self.username == other.username and
                 self.domain == other.domain)
 
+    def _validate_part(self, value):
+        """Parts cannot contain CRLF for security reasons."""
+        if '\r\n' in value:
+            raise ValueError("invalid address; address parts cannot contain CRLF")
 
 class Group:
 

Lib/test/test_email/test_headerregistry.py

@@ -1437,6 +1437,18 @@ def test_il8n(self):
     #    with self.assertRaises(ValueError):
     #        Address('foo', 'wők', 'example.com')
 
+    def test_crlf_in_display_name_raises(self):
+        with self.assertRaisesRegex(ValueError, "invalid address"):
+            Address(display_name='example.com\r\n')
+
+    def test_crlf_in_username_raises(self):
+        with self.assertRaisesRegex(ValueError, "invalid address"):
+            Address(username='hello\r\n')
+
+    def test_crlf_in_domain_raises(self):
+        with self.assertRaisesRegex(ValueError, "invalid address"):
+            Address(domain='example.com\r\n')
+
     def test_non_ascii_username_in_addr_spec_raises(self):
         with self.assertRaises(ValueError):
             Address('foo', addr_spec='wők@example.com')

Misc/NEWS.d/next/Security/2020-03-15-01-28-36.bpo-39073.6Szd3i.rst

@@ -0,0 +1 @@
+Validate email.headerregistry.Address to disallow CRLF in address parts (username, domain, display_name).