Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

mime/quotedprintable: LWSP-char not accepted between = and CRLF #70952

Open
emersion opened this issue Dec 21, 2024 · 3 comments · May be fixed by #70951
Open

mime/quotedprintable: LWSP-char not accepted between = and CRLF #70952

emersion opened this issue Dec 21, 2024 · 3 comments · May be fixed by #70951
Labels
FixPending Issues that have a fix which has not yet been reviewed or submitted.
Milestone

Comments

@emersion
Copy link
Contributor

emersion commented Dec 21, 2024

Go version

go version go1.23.4 linux/amd64

Output of go env in your module/workspace:

GO111MODULE=''
GOARCH='amd64'
GOBIN=''
GOCACHE='/home/simon/.cache/go-build'
GOENV='/home/simon/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/home/simon/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/home/simon/go'
GOPRIVATE=''
GOPROXY='direct'
GOROOT='/usr/lib/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='local'
GOTOOLDIR='/usr/lib/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.23.4'
GODEBUG=''
GOTELEMETRY='local'
GOTELEMETRYDIR='/home/simon/.config/go/telemetry'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/home/simon/src/go-imap/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2161554395=/tmp/go-build -gno-record-gcc-switches'

What did you do?

Try to decode the following MIME message:

https://github.com/dovecot/imaptest/blob/73dcb3ff9ae8b6859ceaf383f21c5b62a9fd7500/src/tests/fetch-binary-mime-qp.mbox

RFC 2045 section 6.7 allows a transport-padding (see details in #70951).

What did you see happen?

quotedprintable: invalid bytes after =: " \r\n"
quotedprintable: invalid bytes after =: "\t \r\n"

What did you expect to see?

No error.

emersion added a commit to emersion/go that referenced this issue Dec 21, 2024
SP and HTAB are allowed after a = before the following CRLF.

RFC 2045 section 6.7 describes the ABNF for the quoted-printable
encoding:

    qp-line := *(qp-segment transport-padding CRLF)
               qp-part transport-padding
    qp-segment := qp-section *(SPACE / TAB) "="
    transport-padding := *LWSP-char
                          ; Composers MUST NOT generate
                          ; non-zero length transport
                          ; padding, but receivers MUST
                          ; be able to handle padding
                          ; added by message transports.

RFC 822 defines LWSP-char as:

    LWSP-char   =  SPACE / HTAB

Dovecot's imaptest contains such a message in
src/tests/fetch-binary-mime-qp.mbox.

Fixes golang#70952
@emersion emersion linked a pull request Dec 21, 2024 that will close this issue
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/638276 mentions this issue: mime/quotedprintable: accept LWSP-char after =

@dr2chase
Copy link
Contributor

@neild @minux

@dr2chase dr2chase added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Dec 21, 2024
emersion added a commit to emersion/go that referenced this issue Dec 22, 2024
SP and HTAB are allowed after a = before the following CRLF.

RFC 2045 section 6.7 describes the ABNF for the quoted-printable
encoding:

    qp-line := *(qp-segment transport-padding CRLF)
               qp-part transport-padding
    qp-segment := qp-section *(SPACE / TAB) "="
    transport-padding := *LWSP-char
                          ; Composers MUST NOT generate
                          ; non-zero length transport
                          ; padding, but receivers MUST
                          ; be able to handle padding
                          ; added by message transports.

RFC 822 defines LWSP-char as:

    LWSP-char   =  SPACE / HTAB

Dovecot's imaptest contains such a message in
src/tests/fetch-binary-mime-qp.mbox.

Fixes golang#70952
@Jorropo Jorropo added this to the Go1.25 milestone Dec 23, 2024
@Jorropo Jorropo added NeedsFix The path to resolution is known, but the work has not been done. FixPending Issues that have a fix which has not yet been reviewed or submitted. and removed NeedsFix The path to resolution is known, but the work has not been done. NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. labels Dec 23, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
FixPending Issues that have a fix which has not yet been reviewed or submitted.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

5 participants