Skip to content

gh-159631: Reject NUL in memoryview credentials in IMAP4.login_plain() - #159633

Open
fedonman wants to merge 1 commit into
python:mainfrom
fedonman:fix-imaplib-login-plain-nul
Open

fedonman wants to merge 1 commit into
python:mainfrom
fedonman:fix-imaplib-login-plain-nul

Conversation

@fedonman

@fedonman fedonman commented Oct 17, 2026 •

Copy link
Copy Markdown
Contributor

login_plain() now converts the user name and password to bytes before checking them for NUL, so the check also applies to a memoryview or another bytes-like object.

$ ./python -m test test_imaplib -u network
...
1 test OK.

Total duration: 56.0 sec
Total tests: run=263
Total test files: run=1/1
Result: SUCCESS

…plain()

The NUL check ran before the user name and password were converted to
bytes, so for a memoryview or another bytes-like object other than
bytes and bytearray it compared integer items and never matched.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant