internal/export/idna: avoid excessive work in Punycode encoding Punycode encoding (conversion to ASCII) is an inherently quadratic algorithm. Avoid excessive CPU consumption when processing long, potentially-untrusted inputs. Decoding applied a cap of 1024 runes to inputs, but encoding had no limit. Reduce the limit to 256 runes (still many more than can appear in any valid DNS label) and apply it to both encoding and decoding. Also avoid repeated UTF-8 decoding in encode by copying the input string to a []rune buffer. Also avoid allocations in encode and decode by using a stack-allocated [64]rune buffer for most operations (including all operations on valid DNS names) and only allocating when overflowing the buffer. Thanks to KC1zs4 (https://github.com/KC1zs4) for reporting this issue. Fixes CVE-2026-97044 For golang/go#82374 Change-Id: Ib5027a79fe76cdd9a382d0dff715ec856a6a6964 Reviewed-on: https://go-review.googlesource.com/c/text/+/851765 Reviewed-by: Neal Patel <neal@golang.org> Reviewed-by: Neal Patel <nealpatel@google.com> LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
This repository holds supplementary Go packages for text processing, many involving Unicode.
It is important that the Unicode version used in x/text matches the one used by your Go compiler. The x/text repository supports multiple versions of Unicode and will match the version of Unicode to that of the Go compiler. At the moment this is supported for Go compilers from version 1.7.
To submit changes to this repository, see http://go.dev/doc/contribute.
The git repository is https://go.googlesource.com/text.
To generate the tables in this repository (except for the encoding tables), run go generate from this directory. By default tables are generated for the Unicode version in core and the CLDR version defined in golang.org/x/text/unicode/cldr.
Running go generate will as a side effect create a DATA subdirectory in this directory, which holds all files that are used as a source for generating the tables. This directory will also serve as a cache.
Run
go test ./...
from this directory to run all tests. Add the “-tags icu” flag to also run ICU conformance tests (if available). This requires that you have the correct ICU version installed on your system.
TODO:
To generate the tables in this repository (except for the encoding tables), run go generate from this directory. By default tables are generated for the Unicode version in core and the CLDR version defined in golang.org/x/text/unicode/cldr.
Running go generate will as a side effect create a DATA subdirectory in this directory which holds all files that are used as a source for generating the tables. This directory will also serve as a cache.
To update a Unicode version run
UNICODE_VERSION=x.x.x go generate
where x.x.x must correspond to a directory in https://www.unicode.org/Public/. If this version is newer than the version in core it will also update the relevant packages there. The idna package in x/net will always be updated.
To update a CLDR version run
CLDR_VERSION=version go generate
where version must correspond to a directory in https://www.unicode.org/Public/cldr/.
Note that the code gets adapted over time to changes in the data and that backwards compatibility is not maintained. So updating to a different version may not work.
The files in DATA/{iana|icu|w3|whatwg} are currently not versioned.
The main issue tracker for the text repository is located at https://go.dev/issues. Prefix your issue with “x/text:” in the subject line, so it is easy to find.