JoshData / JoshData/python-email-validator
Ability to disallow confusing unicode characters to prevent homoglyph phishing attacks
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 1.4k
- Forks
- 140
- PR merge metrics
- No merged PRs in 30d
Description
When emails contain unicode characters that look similar to ascii characters, an attack vector is possible anytime we display the unicode email as an identifier of a user without punycode encoding the displayed email.
It would be nice to have an option to make confusing unicode characters fail email validation, but might be outside the scope of this library since it depends on the external confusables.txt data file from unicode.org?
The Unicode Consortium's Visual Spoofing Recommendations agree with this solution as a better alternative than blocking all unicode characters in domains and emails.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the email validation entry points and the Unicode TR39 confusables data referenced in the issue. Determine how an opt-in rejection mode should use confusables.txt, and consider the work done when confusing Unicode characters are rejected without blocking all Unicode addresses.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100