#5871: protect against header injection attacks.
This makes Header.encode throw a HeaderParseError if it winds up
formatting a header such that a continuation line has no leading
whitespace and looks like a header. Since Header accepts values
containing newlines and preserves them (and this is by design), without
this fix any program that took user input (say, a subject in a web form)
and passed it to the email package as a header was vulnerable to header
injection attacks. (As far as we know this has never been exploited.)
Thanks to Jakub Wilk for reporting this vulnerability.
diff --git a/Misc/NEWS b/Misc/NEWS
index c1d4260..2f8b6db 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -40,6 +40,13 @@
Library
-------
+- Issue #5871: email.header.Header.encode now raises an error if any
+ continuation line in the formatted value has no leading white space
+ and looks like a header. Since Generator uses Header to format all
+ headers, this check is made for all headers in any serialized message
+ at serialization time. This provides protection against header
+ injection attacks.
+
- Issue #10859: Make ``contextlib.GeneratorContextManager`` officially
private by renaming it to ``_GeneratorContextManager``.