[2.7] bpo-34155: Dont parse domains containing @ (GH-13079)

[rcsanchez97]

This change skips parsing of email addresses where domains include a "@" character, which can be maliciously used since the local part is returned as a complete address.

(cherry picked from commit 8cb65d1)

Excludes changes to Lib/email/_header_value_parser.py, which did not
exist in 2.7.

Co-authored-by: jpic [email protected]

https://bugs.python.org/issue34155

Automerge-Triggered-By: @maxking

[the-knights-who-say-ni]

Hello, and thanks for your contribution!

I'm a bot set up to make sure that the project can legally accept this contribution by verifying everyone involved has signed the PSF contributor agreement (CLA).

Recognized GitHub username

We couldn't find a bugs.python.org (b.p.o) account corresponding to the following GitHub usernames:

@rcsanchez97

This might be simply due to a missing "GitHub Name" entry in one's b.p.o account settings. This is necessary for legal reasons before we can look at this contribution. Please follow the steps outlined in the CPython devguide to rectify this issue.

You can check yourself to see if the CLA has been received.

Thanks again for the contribution, we look forward to reviewing it!

[vstinner]

@rcsanchez97: Can you please sign the CLA? See the previous comment for the procedure.

[rcsanchez97]

@vstinner That is very strange. I signed the CLA at the same time I created the PR. However, the CLA not signed label was only removed moments ago when I used the link to check that it had been recorded as being signed.

[vstinner]

LGTM. But I would prefer to have a double check from another core dev.

@maxking or @warsaw: Can you please review this PR?

I compared with 8cb65d1 : the code looks the same. The 2.7 backport lacks the get_domain() change which raises HeaderParseError: Python 2.7 doens't have the parser.get_addr_spec() function, so I understand that it doesn't need this change.

[maxking]

LGTM!

Thank @rcsanchez97 for the backport and @vstinner for helping review.