mathiasbynens / mathiasbynens/punycode.js

Incorrect converting of 👁 & 👁️

Open
#145 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
1.7k
Forks
170
PR merge metrics
No merged PRs in 30d

Description

$ cat puny.js
#! /usr/bin/node

const punycode = require('punycode/');

console.log(punycode.toUnicode("xn--mp8h"));
console.log(punycode.toUnicode("xn--v86cr064b"));
console.log(punycode.toASCII("👁"));
console.log(punycode.toASCII("👁️"));

$ ./puny.js
👁
👁️
xn--mp8h
xn--v86cr064b

The punycode xn--v86cr064b is invalid, so should throw an error or something, and both code points should map to xn--mp8h - this is the result you will get from Python's integrated .idn() encoding and the result you get from https://www.punycoder.com/

$ python3
Python 3.12.12 (main, Oct 11 2025, 15:09:54) [GCC 14.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> utf8="👁"
>>> print(utf8.encode("idna"))
b'xn--mp8h'
>>> utf8="👁️"
>>> print(utf8.encode("idna"))
b'xn--mp8h'
>>>
Image

You could def make the case your code was never intended to be IDNA compliant, but only a punycode converter - however, if it is outputting domain names that are effectively "illegal", this seems to me highly undesirable behaviour - or at least, something users need an obvious and strongly worded warning about.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the puny.js reproduction and run the four toUnicode/toASCII calls shown in the issue. Read the converter's RFC 3492 and RFC 5891 behavior, then establish whether these inputs should normalize to the same output or reject the invalid result. Done means the chosen behavior is documented and verified for both eye-symbol variants.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
networking, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.