https://github.com/python/cpython/commit/37452c7db46b89a61f1d8322751f2bf0f5b05888 commit: 37452c7db46b89a61f1d8322751f2bf0f5b05888 branch: main author: Stan Ulbrych <[email protected]> committer: encukou <[email protected]> date: 2026-09-15T17:18:39+02:00 summary:
gh-144133: Add warning about untrusted input to the `idna` codec (GH-155475) files: M Doc/library/codecs.rst diff --git a/Doc/library/codecs.rst b/Doc/library/codecs.rst index e0e69e71e843e7..311437a67f6e81 100644 --- a/Doc/library/codecs.rst +++ b/Doc/library/codecs.rst @@ -1395,6 +1395,15 @@ encodings. | | | :mod:`encodings.idna`. | | | | Only ``errors='strict'`` | | | | is supported. | +| | | | +| | | .. warning:: | +| | | | +| | | This codec builds on | +| | | ``punycode``, whose | +| | | algorithms scale | +| | | poorly, so limit the | +| | | length of untrusted | +| | | input. | +--------------------+---------+---------------------------+ | mbcs | ansi, | Windows only: Encode the | | | dbcs | operand according to the | @@ -1646,6 +1655,11 @@ Applications) and :rfc:`3492` (Nameprep: A Stringprep Profile for Internationalized Domain Names (IDN)). It builds upon the ``punycode`` encoding and :mod:`stringprep`. +.. warning:: + + This module builds on ``punycode``, whose algorithms scale poorly, so limit + the length of untrusted input. + If you need the IDNA 2008 standard from :rfc:`5891` and :rfc:`5895`, use the third-party :pypi:`idna` module. _______________________________________________ Python-checkins mailing list -- [email protected] To unsubscribe send an email to [email protected] https://mail.python.org/mailman3//lists/python-checkins.python.org Member address: [email protected]
