When str.lower() is a security vulnerability in Python

Re:When str.lower() is a security vulnerability in Python – ... by philipwhiuk on Wednesday August 26, 2026 @06:20AM (#49446552)

To be clear (because the snippet is non-explanatory).

For encode("idna") what they did is use lower() except where it would produce a result different to 3.2.0 and then instead use the result from 3.2.0 instead.

Essentially they've frozen the IDNA encoding to be based on 3.2.0 by overriding any changes.

[ Parent | on HN ]

Re:When str.lower() is a security vulnerability in Python – ... by ryukoposting on Wednesday August 26, 2026 @06:42AM (#49446730)

Yeah. I can understand the confusion, though. The title claims the issue was in lower(). Though the problem was actually in encode('idna')'s usage of lower().

The article would probably get far fewer clicks if it were named "when encode('idna') is a security vulnerability"

[ Parent | on HN ]

Re:When str.lower() is a security vulnerability in Python – ... by ummonk on Wednesday August 26, 2026 @11:25AM (#49450825)

Yeah, that's what I figured, but my worry upon seeing this is "what happens if lower() changes again and people forget to update the list of exceptions?".

Unless they have unit testing on the entire Unicode code space to ensure what they're doing is always identical to 3.2.0.

[ Parent | on HN ]