Menu

When str.lower() is a security vulnerability in Python
📰

When str.lower() is a security vulnerability in Python

Hacker News·2 months ago
#sby7P6M3
#sethmlarson#python#unicode#idna#stringprep
Reading 0:00
15s threshold

Some internet standards only support ASCII characters, but the world uses much more than the Latin alphabet. Thus, a mapping from Unicode to ASCII for use in domain names is required.

NamePrep was part of that solution, defined in RFC 3491 as a profile of StringPrep, and is crucially a component of Internationalizing Domain Names in Applications (IDNA), also known as “IDNA 2003”. The StringPrep algorithm is defined in RFC 3454 . IDNA 2003 has been obsoleted by IDNA 2008 defined in RFC 5890 , 5891 , 5892 , and 5893 .

Python supports IDNA 2003 through the idna codec ( str.encode('idna') ) and IDNA 2008 is supported by the idna package on the Python package Index . Python's implementation of StringPrep is implemented in the stringprep module in the standard library.…

Continue reading — create a free account

Join HashtagPLUS to read full articles, follow hashtags, vote, and join the conversation.