https://github.com/python/cpython/commit/79328d48f3897eedce734e5e08c90290a717d2ed commit: 79328d48f3897eedce734e5e08c90290a717d2ed branch: 3.14 author: Miss Islington (bot) <[email protected]> committer: StanFromIreland <[email protected]> date: 2026-09-15T16:43:36+01:00 summary:
[3.14] gh-144133: Add warning about untrusted input to the `idna` codec (GH-155475) (#157562) (cherry picked from commit 37452c7db46b89a61f1d8322751f2bf0f5b05888) Co-authored-by: Stan Ulbrych <[email protected]> files: M Doc/library/codecs.rst diff --git a/Doc/library/codecs.rst b/Doc/library/codecs.rst index cf17e0d34dc2a6..d03d19d318b85b 100644 --- a/Doc/library/codecs.rst +++ b/Doc/library/codecs.rst @@ -1380,6 +1380,15 @@ encodings. | | | :mod:`encodings.idna`. | | | | Only ``errors='strict'`` | | | | is supported. | +| | | | +| | | .. warning:: | +| | | | +| | | This codec builds on | +| | | ``punycode``, whose | +| | | algorithms scale | +| | | poorly, so limit the | +| | | length of untrusted | +| | | input. | +--------------------+---------+---------------------------+ | mbcs | ansi, | Windows only: Encode the | | | dbcs | operand according to the | @@ -1624,6 +1633,11 @@ Applications) and :rfc:`3492` (Nameprep: A Stringprep Profile for Internationalized Domain Names (IDN)). It builds upon the ``punycode`` encoding and :mod:`stringprep`. +.. warning:: + + This module builds on ``punycode``, whose algorithms scale poorly, so limit + the length of untrusted input. + If you need the IDNA 2008 standard from :rfc:`5891` and :rfc:`5895`, use the third-party :pypi:`idna` module. _______________________________________________ Python-checkins mailing list -- [email protected] To unsubscribe send an email to [email protected] https://mail.python.org/mailman3//lists/python-checkins.python.org Member address: [email protected]
