https://github.com/python/cpython/commit/87b459e3121b8dbbcfc8127eae7bc16ee2f5d181 commit: 87b459e3121b8dbbcfc8127eae7bc16ee2f5d181 branch: 3.15 author: Miss Islington (bot) <[email protected]> committer: hugovk <[email protected]> date: 2026-09-15T19:01:14+03:00 summary:
[3.15] gh-144133: Add warning about untrusted input to the `idna` codec (GH-155475) (#157561) Co-authored-by: Stan Ulbrych <[email protected]> files: M Doc/library/codecs.rst diff --git a/Doc/library/codecs.rst b/Doc/library/codecs.rst index 99fcf35aa893e4..c6724243e0f3ea 100644 --- a/Doc/library/codecs.rst +++ b/Doc/library/codecs.rst @@ -1383,6 +1383,15 @@ encodings. | | | :mod:`encodings.idna`. | | | | Only ``errors='strict'`` | | | | is supported. | +| | | | +| | | .. warning:: | +| | | | +| | | This codec builds on | +| | | ``punycode``, whose | +| | | algorithms scale | +| | | poorly, so limit the | +| | | length of untrusted | +| | | input. | +--------------------+---------+---------------------------+ | mbcs | ansi, | Windows only: Encode the | | | dbcs | operand according to the | @@ -1626,6 +1635,11 @@ Applications) and :rfc:`3492` (Nameprep: A Stringprep Profile for Internationalized Domain Names (IDN)). It builds upon the ``punycode`` encoding and :mod:`stringprep`. +.. warning:: + + This module builds on ``punycode``, whose algorithms scale poorly, so limit + the length of untrusted input. + If you need the IDNA 2008 standard from :rfc:`5891` and :rfc:`5895`, use the third-party :pypi:`idna` module. _______________________________________________ Python-checkins mailing list -- [email protected] To unsubscribe send an email to [email protected] https://mail.python.org/mailman3//lists/python-checkins.python.org Member address: [email protected]
