https://github.com/python/cpython/commit/8404e15cbb42e30a89b41158b5ec84c49503877f commit: 8404e15cbb42e30a89b41158b5ec84c49503877f branch: 3.13 author: Miss Islington (bot) <[email protected]> committer: StanFromIreland <[email protected]> date: 2026-09-15T16:43:29+01:00 summary:
[3.13] gh-144133: Add warning about untrusted input to the `idna` codec (GH-155475) (#157563) (cherry picked from commit 37452c7db46b89a61f1d8322751f2bf0f5b05888) Co-authored-by: Stan Ulbrych <[email protected]> files: M Doc/library/codecs.rst diff --git a/Doc/library/codecs.rst b/Doc/library/codecs.rst index e88992917573ea..417b4546c1f1eb 100644 --- a/Doc/library/codecs.rst +++ b/Doc/library/codecs.rst @@ -1369,6 +1369,15 @@ encodings. | | | :mod:`encodings.idna`. | | | | Only ``errors='strict'`` | | | | is supported. | +| | | | +| | | .. warning:: | +| | | | +| | | This codec builds on | +| | | ``punycode``, whose | +| | | algorithms scale | +| | | poorly, so limit the | +| | | length of untrusted | +| | | input. | +--------------------+---------+---------------------------+ | mbcs | ansi, | Windows only: Encode the | | | dbcs | operand according to the | @@ -1601,6 +1610,11 @@ Applications) and :rfc:`3492` (Nameprep: A Stringprep Profile for Internationalized Domain Names (IDN)). It builds upon the ``punycode`` encoding and :mod:`stringprep`. +.. warning:: + + This module builds on ``punycode``, whose algorithms scale poorly, so limit + the length of untrusted input. + If you need the IDNA 2008 standard from :rfc:`5891` and :rfc:`5895`, use the third-party :pypi:`idna` module. _______________________________________________ Python-checkins mailing list -- [email protected] To unsubscribe send an email to [email protected] https://mail.python.org/mailman3//lists/python-checkins.python.org Member address: [email protected]
