email.headerregistry.Address rejects CR and LF in its arguments (Lib/email/headerregistry.py), but the legacy email.utils.formataddr() passes them straight into the returned header string:
>>> from email.utils import formataddr
>>> formataddr(("Alice\r\nBcc: [email protected]", "[email protected]"))
'"Alice\r\nBcc: [email protected]" <[email protected]>'
>>> formataddr(("Alice", "[email protected]\r\nSubject: spoofed"))
'Alice <[email protected]\r\nSubject: spoofed>'formataddr() is documented as producing a value suitable for a From/To/Cc header and is often used to build header strings directly, so it should reject CR/LF the same way Address does.
Linked PRs
email.headerregistry.Address rejects CR and LF in its arguments (Lib/email/headerregistry.py), but the legacy email.utils.formataddr() passes them straight into the returned header string:
formataddr() is documented as producing a value suitable for a From/To/Cc header and is often used to build header strings directly, so it should reject CR/LF the same way Address does.
Linked PRs