-
-
Notifications
You must be signed in to change notification settings - Fork 97
Description
-Describe the bug
An email address will not be parsed in the display name is also an email address. This is because the Python library module email.utils, (used by mail-parser here) ignores malformed email addresses by default for security reasons. see [CVE-2023-27043] using the default option strict=True. This fix was introduced in Python 3.13 but backported to older Python versions.
For example,
From: alice@example.com <bob@example.com> is parsed as [('', '')]
This type of malformed email address is explicitly called out in the code comments
python/cpython@4a153a1#diff-aef09e3b2ee5f278fa8a8908e2400c129fa3774ee4d5fefe2afa8789c8331267R163
To Reproduce
Parse an email with a from address that has a display name that is also an email address.
Expected behavior
Considering mail-parser is often used to parse benign and malicious emails, rather than refusing to parse those addresses, I would prefer this output:
[('alice@example.com', 'bob@example.com')]
Raw mail
From: alice@example.com <bob@example.com>
To: example@example.com
Subject: Example Email
Hello world!Environment
- OS: Linux
- Docker: No
- Python version: 3.11.2
- mail-parser version 4.1.2