René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"email.generator.Generator ignores policy when using `multipart/signed` → ruins signing","articleBody":"# Bug report\r\n\r\nEmailMessage behaves differently when being set to `multipart/signed` mimetype.\r\n\r\n```python3\r\nfrom email.message import EmailMessage\r\n\r\ninner = EmailMessage()\r\ninner.add_attachment(\"some data\", \"text/plain\", filename=\"*\"*35)\r\n\r\nouter1 = EmailMessage()\r\nouter1.set_type(\"multipart/signed\")  # affected by generator.py/_handle_multipart_signed\r\nouter1.attach(inner)\r\n\r\nouter2 = EmailMessage()\r\nouter2.set_type(\"multipart/signeX\")  # not affected by generator.py/_handle_multipart_signed\r\nouter2.attach(inner)\r\n\r\n# When accessing given submessage, nothing weird happens\r\nouter1.get_payload()[0].as_string() == outer2.get_payload()[0].as_string()  # True\r\n\r\n# However, when accessing whole message at once, headers folding change for the outer1 `multipart/signed` message\r\ninner.as_string() in outer1.as_string()  # !False!\r\ninner.as_string() in outer2.as_string()  # True\r\n```\r\n\r\nThis is due to a 13 years old [generator.py](https://github.com/python/cpython/blob/00437ad30454005bc82fca75dfbabf6c95f3ea6a/Lib/email/generator.py#L319) code that for an unknown reason rewrites the policy so that no header was folded:\r\n\r\n```python3\r\n    def _handle_multipart_signed(self, msg):\r\n        # The contents of signed parts has to stay unmodified in order to keep\r\n        # the signature intact per RFC1847 2.1, so we disable header wrapping.\r\n        # RDM: This isn't enough to completely preserve the part, but it helps.\r\n        p = self.policy\r\n        self.policy = p.clone(max_line_length=0)\r\n        try:\r\n            self._handle_multipart(msg)\r\n        finally:\r\n            self.policy = p\r\n```\r\n\r\nAs a result, when I GPG-sign the `inner` message and attach it to a wrapping-`outer` message along with the signature (which is the right thing), the signature is void because policy being ignored, the headers folding got disabled on the output. I understand the method `_handle_multipart_signed` should help the message signing but it ruins it instead. One dirty solution would be to set the policy to `max_line_length=0` which fails for whatever reason:\r\n\r\n```python3\r\nfrom email import policy\r\npol = policy.default.clone(max_line_length=0)\r\ninner = EmailMessage(policy=pol)\r\ninner.add_attachment(\"some data\", \"text/plain\", filename=\"*\"*35)  # ValueError: maxlinelen must be at least 4\r\n```\r\n\r\nTherefore, I am not able to sign the `inner` message with the headers fold (as it is output unfold), not I am able to sign the `inner` message with the headers unfold (as `ValueError` prevents me to set the policy to not stop folding headers).\r\n\r\nSo my proposal is to remove `_handle_multipart_signed` altogether (which would be sufficient) or to find a use-case where it does make sense (I could not find any).\r\n\r\n# Your environment\r\n\r\n- CPython versions tested on: Python 3.10.6\r\n- Operating system and architecture:  Ubuntu 22.04.1 LTS x86_64\r\n\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-100204\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/e3rd","@type":"Person","name":"e3rd"},"datePublished":"2022-11-16T14:05:00.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/99533/cpython/issues/99533"}