gh-66788: Strictly enforce the modified Base64 alphabet in utf-7-imap

Decode the modified Base64 with binascii.a2b_base64() and the modified
alphabet directly, instead of base64.b64decode() with altchars.  With
strict_mode the "/" character (used by standard Base64 but not by the
modified alphabet, which uses ",") is now rejected rather than accepted
with a DeprecationWarning.  Encoding likewise uses binascii.b2a_base64().

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: serhiy-storchaka

Lib/encodings/utf_7_imap.py

@@ -13,7 +13,10 @@
 
 import binascii
 import codecs
-from base64 import b64encode, b64decode
+
+# The modified Base64 alphabet of RFC 3501: standard Base64 but with "," in
+# place of "/".
+_alphabet = binascii.BASE64_ALPHABET[:-1] + b','
 
 ### Codec APIs
 
@@ -26,8 +29,9 @@ def utf_7_imap_encode(input, errors='strict'):
     def flush(end):
         if start < end:
             if b64run:
-                b64 = b64encode(input[start:end].encode('utf-16-be'),
-                                altchars=b'+,', padded=False)
+                b64 = binascii.b2a_base64(input[start:end].encode('utf-16-be'),
+                                          alphabet=_alphabet, padded=False,
+                                          newline=False)
                 res.extend(b'&' + b64 + b'-')
             else:
                 res.extend(input[start:end].encode('ascii'))
@@ -74,8 +78,8 @@ def flush(end):
             else:
                 b64 = input[i + 1:j]
                 try:
-                    data = b64decode(b64, altchars=b'+,',
-                                     validate=True, padded=False)
+                    data = binascii.a2b_base64(b64, alphabet=_alphabet,
+                                               strict_mode=True, padded=False)
                 except binascii.Error:
                     data = b''
                 if not data or len(data) % 2:

Lib/test/test_codecs.py

@@ -1421,7 +1421,7 @@ def test_decode_invalid(self):
     ('a\tb', b'a&AAk-b'),
     ('\x00', b'&AAA-'),
     ('Entw\xfcrfe', b'Entw&APw-rfe'),
-    ('ϰ', b'&A,A-'),                     # "," in the modified Base64 alphabet
+    ('ϰ', b'&A,A-'),                     # "," in the Base64 alphabet ("&A/A-" is invalid)
     ('☃', b'&JgM-'),                     # snowman
     ('\U0001f600', b'&2D3eAA-'),              # non-BMP (surrogate pair)
     ('Sent &\N{DELETE}', b'Sent &-&AH8-'),
@@ -1441,6 +1441,7 @@ def test_decode(self, uni, encoded):
         (b'x&', 1),             # "&" just before the end, unterminated
         (b'&AAAA', 0),          # unterminated, though the Base64 is valid
         (b'&AB-', 0),           # Base64 length not a multiple of a code unit
+        (b'&A/A-', 0),          # "/" not in the alphabet ("&A,A-" is valid)
         (b'&@@@-', 0),          # invalid Base64
         (b'a\x80b', 1),         # 8-bit byte outside a shift sequence
         (b'a\x1fb', 1),         # control byte outside a shift sequence