internal/export/idna: always treat Punycode encoding pure ASCII as an error UTS 46 revision 33 specifies that it is an error for a Punycode label to encode an ASCII-only string, such as "xn--example-.com" encoding "example.com". Earlier versions of UTS 46 contained a specification bug which permitted this. Don't make the fix conditional on the Go toolchain version; we should never accept these labels. For golang/go#78760 Change-Id: I93beac3f44251e68a7faa3ea8b5963526a6a6964 Reviewed-on: https://go-review.googlesource.com/c/text/+/796420 LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Nicholas Husin <nsh@golang.org> Reviewed-by: Nicholas Husin <husin@google.com>
diff --git a/internal/export/idna/idna.go b/internal/export/idna/idna.go index 46e6e03..721a246 100644 --- a/internal/export/idna/idna.go +++ b/internal/export/idna/idna.go
@@ -400,7 +400,11 @@ // Spec says keep the old label. continue } - if unicode16 && err == nil && len(u) > 0 && isASCII(u) { + if err == nil && len(u) > 0 && isASCII(u) { + // UTS 43 pre-revision 33 doesn't classify a xn-- label + // which contains only ASCII characters as an error, + // but that's a specification bug and a security issue. + // Always return an error in this case. err = punyError(enc) } isBidi = isBidi || bidirule.DirectionString(u) != bidi.LeftToRight