2 ms·
To be clear (because the snippet is non-explanatory). For encode("idna") what they did is use lower() except where it would produce a result different to 3.2.0
by philipwhiuk 2mo ago
To be clear (because the snippet is non-explanatory).
For encode("idna") what they did is use lower() except where it would produce a result different to 3.2.0 and then instead use the result from 3.2.0 instead.
Essentially they've frozen the IDNA encoding to be based on 3.2.0 by overriding any changes.
- ryukoposting 2mo agoYeah. I can understand the confusion, though. The title claims the issue was in lower(). Though the problem was actually in encode('idna')'s usage of lower(). The article would probably get far fewer clicks if it were named "when encode('idna') is a security vulnerability"
- ummonk 2mo agoYeah, that's what I figured, but my worry upon seeing this is "what happens if lower() changes again and people forget to update the list of exceptions?". Unless they have unit testing on the entire Unicode code space to ensure what they're doing is always identical to 3.2.0.