Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/text: *Profile.process to throw labelError if verifyDNSLength = true and s ends with trailing dot. #43

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

x/text: *Profile.process to throw labelError if verifyDNSLength = true and s ends with trailing dot. #43

wants to merge 2 commits into from
+28 −14

Conversation

elliotwutingfeng
Copy link

@elliotwutingfeng elliotwutingfeng commented Jun 18, 2023 •
edited
Loading

Issue

The existing implementation of *Profile.process erroneously accepts trailing dots when verifyDNSLength is true.

This behavior is described in the Unicode Technical Standard 46 at https://unicode.org/reports/tr46/#ToASCII

Proposed change

*Profile.process to reject trailing dots when verifyDNSLength is true.

Fixes golang/go#47182

@elliotwutingfeng
idna: *labelIter.next() to skip last label only if it is empty and ve…
f99f2cf 
…rifyDNSLength is false.

The existing implementation always skips the empty last label regardless of what verifyDNSLength is set to, which causes pure-ASCII domains ending with a single empty root label to be wrongly accepted when verifyDNSLength is true.

This behavior is described in the Unicode Technical Standard 46 at https://unicode.org/reports/tr46/\#ToASCII

Fixes golang/go#47182
@gopherbot
Copy link
Contributor

This PR (HEAD: f99f2cf) has been imported to Gerrit for code review.

Please visit https://go-review.googlesource.com/c/text/+/504255 to see it.

Tip: You can toggle comments from me using the comments slash command (e.g. /comments off)
See the Wiki page for more info

@gopherbot
Copy link
Contributor

Message from Gopher Robot:

Patch Set 1:

Congratulations on opening your first change. Thank you for your contribution!

Next steps:
A maintainer will review your change and provide feedback. See
https://go.dev/doc/contribute#review for more info and tips to get your
patch through code review.

Most changes in the Go project go through a few rounds of revision. This can be
surprising to people new to the project. The careful, iterative review process
is our way of helping mentor contributors and ensuring that their contributions
have a lasting impact.

During May-July and Nov-Jan the Go project is in a code freeze, during which
little code gets reviewed or merged. If a reviewer responds with a comment like
R=go1.11 or adds a tag like "wait-release", it means that this CL will be
reviewed as part of the next development cycle. See https://go.dev/s/release
for more details.

Please don’t reply on this GitHub thread. Visit golang.org/cl/504255.
After addressing review feedback, remember to publish your drafts!

@gopherbot
Copy link
Contributor

Message from Marcel van Lohuizen:

Patch Set 1: Code-Review+1

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/504255.
After addressing review feedback, remember to publish your drafts!

@elliotwutingfeng elliotwutingfeng mentioned this pull request Jun 22, 2023
Open
@zeroizerz
Copy link

As per golang/go#58778 (comment):

The root label should be disallowed when VerifyDNSLength is true, so www.éxamplé.ćóḿ. should also be rejected but is currently not. So this problem does not only affect ASCII labels as believed in #47182.

@elliotwutingfeng
idna: *Profile.process to throw labelError if verifyDNSLength = true …
8e763eb 
…and s ends with trailing dot.

From UTS46, no trailing dots are allowed when ToASCII is called with verifyDNSLength = true. This negates the need for an additional l.verifyDNSLength flag in the previous commit.

See https://www.unicode.org/L2/L2021/21170-utc169-properties-recs.pdf under section F2

Fixes golang/go#47182
@elliotwutingfeng elliotwutingfeng changed the title x/text: *labelIter.next() to skip last label only if it is empty and verifyDNSLength is false x/text: *Profile.process to throw labelError if verifyDNSLength = true and s ends with trailing dot. Jun 22, 2023
@gopherbot
Copy link
Contributor

This PR (HEAD: 8e763eb) has been imported to Gerrit for code review.

Please visit https://go-review.googlesource.com/c/text/+/504255 to see it.

Tip: You can toggle comments from me using the comments slash command (e.g. /comments off)
See the Wiki page for more info

@gopherbot
Copy link
Contributor

Message from Wu Tingfeng:

Patch Set 3:

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/504255.
After addressing review feedback, remember to publish your drafts!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

x/net/idna: Registration.ToASCII() accepts empty TLD label
3 participants
@elliotwutingfeng @gopherbot @zeroizerz