Opened 7 years ago

Last modified 7 years ago

#6285 defect new

CramMD5Credentials.setResponse does not check for proper format of parameter 'response'

Reported by: implizit Owned by:
Priority: low Milestone:
Component: core Keywords:
Cc: Branch:
Author:

Description

t.c.credentials.CramMD5Credentials.setResponse assumes that parameter response has a proper format (something like <user><space><response>). However, this is not guaranteed. For example, if you create a small ESMTP-Server with CRAM-MD5-Support, it is possible that the client does not send the proper response. I observed this with Apple Mail. You can test it via telnet by entering:

  EHLO 127.0.0.1
  AUTH CRAM-MD5
  QUIT

In this case, setResponse throws a ValueError. One possible fix is to catch this exception and assign an empty string to self.username and self.reponse. The above "QUIT" will be interpreted as the response, which is IMHO valid w.r.t the RFC.

Change History (1)

comment:1 Changed 7 years ago by Jean-Paul Calderone

Raising an exception when the input is malformed sounds like the right thing to do to me. Silently turning malformed input into garbage values is just a good way to make it hard to debug problems.

It sounds like the real issues here are:

  1. The error cases of setResponse may not be sufficiently documented and/or tested
  2. Protocol code using CramMD5Credentials may not have proper error handling code in place
Note: See TracTickets for help on using tickets.