Non-ASCII hostnames are not validated and so allow "@" and other reserved gen-delims characters
- 主要语言
- Python
- 星标
- 1.5k
- 派生
- 215
- 平均合并
- 1 天 2 分钟
- 30 天内合并 PR
- 13
描述
### Describe the bug
For #880 we fixed handling of _ASCII_ hostnames, rejecting hostnames that contain characters or sequences that are explicitly excluded (see [RFC3986, section 3.2.2, the `reg-name` grammar rule](https://www.rfc-editor.org/rfc/rfc3986#section-3.2.2).
When implementing the PR for this I had tested `idna.encode(host, uts46=True)` and verified that it correctly rejects hostnames that use ASCII characters outside of the `reg-name` rule, not realising that `_idna_encode()` catches the exception raised for this and then falls back to `host.encode('idna')`, which doesn't reject such hostnames.
The exception handling is there to allow for IDNA 2003 / 2008 compatibility (see #152). I suspect that we need to use `idna.encode(host)` instead of `host.encode('idna')` here to ensure that invalid characters are still rejected.
Because there is no validation it is trivial to create invalid URLs, e.g. by passing in a non-ascii authority value to `host` plus a user or password value.
### To Reproduce
```
>>> import yarl
>>> yarl.URL.build(scheme="http", host="user:pass@историк.рф", user="therealusername")
URL('http://therealusername@xn--user:pass@-rtia0a8c4aor.xn--p1ai')
```
### Expected behavior
The `user:pass@историк.рф` host value contains invalid characters, `:` and `@` and so a `ValueError` should have been raised.
贡献指南
评估
这个 Issue 还没有评估数据。