| 83 | | # Note: using super() here is safe; any __setitem__ overrides must use |
|---|
| 84 | | # the same argument signature. |
|---|
| 85 | | super(SafeHeaderMixin, self).__setitem__(name, val) |
|---|
| 86 | | |
|---|
| 87 | | class SafeMIMEText(MIMEText, SafeHeaderMixin): |
|---|
| 88 | | pass |
|---|
| 89 | | |
|---|
| 90 | | class SafeMIMEMultipart(MIMEMultipart, SafeHeaderMixin): |
|---|
| 91 | | pass |
|---|
| | 83 | MIMEText.__setitem__(self, name, val) |
|---|
| | 84 | |
|---|
| | 85 | class SafeMIMEMultipart(MIMEMultipart): |
|---|
| | 86 | def __setitem__(self, name, val): |
|---|
| | 87 | "Forbids multi-line headers, to prevent header injection." |
|---|
| | 88 | if '\n' in val or '\r' in val: |
|---|
| | 89 | raise BadHeaderError, "Header values can't contain newlines (got %r for header %r)" % (val, name) |
|---|
| | 90 | try: |
|---|
| | 91 | val = str(force_unicode(val)) |
|---|
| | 92 | except UnicodeEncodeError: |
|---|
| | 93 | if name.lower() in ('to', 'from', 'cc'): |
|---|
| | 94 | result = [] |
|---|
| | 95 | for item in val.split(', '): |
|---|
| | 96 | nm, addr = parseaddr(item) |
|---|
| | 97 | nm = str(Header(nm, settings.DEFAULT_CHARSET)) |
|---|
| | 98 | result.append(formataddr((nm, str(addr)))) |
|---|
| | 99 | val = ', '.join(result) |
|---|
| | 100 | else: |
|---|
| | 101 | val = Header(force_unicode(val), settings.DEFAULT_CHARSET) |
|---|
| | 102 | MIMEMultipart.__setitem__(self, name, val) |
|---|