Nov 10, 2022 · Nov 8, 2022
diff --git a/Lib/encodings/idna.py b/Lib/encodings/idna.py

 # Check bidi
 RandAL= [stringprep.in_table_d1(x)forxinlabel]
 forcinRandAL:
 ifc:
 # There is a RandAL char in the string. Must perform further
 # tests:
 # 1) The characters in section 5.8 MUST be prohibited.
 # This is table C.8, which was already checked
 # 2) If a string contains any RandALCat character, the string
 # MUST NOT contain any LCat character.
 ifany(stringprep.in_table_d2(x)forxinlabel):
 raiseUnicodeError("Violation of BIDI requirement 2")

 # 3) If a string contains any RandALCat character, a
 # RandALCat character MUST be the first character of the
 # string, and a RandALCat character MUST be the last
 # character of the string.
 ifnotRandAL[0]ornotRandAL[-1]:
 raiseUnicodeError("Violation of BIDI requirement 3")
 ifany(RandAL):
 # There is a RandAL char in the string. Must perform further
 # tests:
 # 1) The characters in section 5.8 MUST be prohibited.
 # This is table C.8, which was already checked
 # 2) If a string contains any RandALCat character, the string
 # MUST NOT contain any LCat character.
 ifany(stringprep.in_table_d2(x)forxinlabel):
 raiseUnicodeError("Violation of BIDI requirement 2")
 # 3) If a string contains any RandALCat character, a
 # RandALCat character MUST be the first character of the
 # string, and a RandALCat character MUST be the last
 # character of the string.
 ifnotRandAL[0]ornotRandAL[-1]:
 raiseUnicodeError("Violation of BIDI requirement 3")

 returnlabel

diff --git a/Lib/test/test_codecs.py b/Lib/test/test_codecs.py
        self.assertEqual("pyth\xf6n.org".encode("idna"), b"xn--pythn-mua.org")
        self.assertEqual("pyth\xf6n.org.".encode("idna"), b"xn--pythn-mua.org.")

    def test_builtin_decode_length_limit(self):
        with self.assertRaisesRegex(UnicodeError, "too long"):
            (b"xn--016c"+b"a"*1100).decode("idna")
        with self.assertRaisesRegex(UnicodeError, "too long"):
            (b"xn--016c"+b"a"*70).decode("idna")

    def test_stream(self):
        r = codecs.getreader("idna")(io.BytesIO(b"abc"))
        r.read(3)
diff --git a/Misc/NEWS.d/next/Security/2022-11-04-09-29-36.gh-issue-98433.l76c5G.rst b/Misc/NEWS.d/next/Security/2022-11-04-09-29-36.gh-issue-98433.l76c5G.rst
 The IDNA codec decoder used on DNS hostnames by:mod:`socket` or:mod:`asyncio`
 related name resolution functions no longer involves a quadratic algorithm.
 This prevents a potential CPU denial of service if an out-of-spec excessive
 length hostname involving bidirectional characters were decoded. Some protocols
 such as:mod:`urllib` http ``3xx`` redirects potentially allow for an attacker
 to supply such a name.
Original file line number	Diff line number	Diff line change
Expand Up		@@ -39,23 +39,21 @@ def nameprep(label):

		# Check bidi
		RandAL= [stringprep.in_table_d1(x)forxinlabel]
		forcinRandAL:
		ifc:
		# There is a RandAL char in the string. Must perform further
		# tests:
		# 1) The characters in section 5.8 MUST be prohibited.
		# This is table C.8, which was already checked
		# 2) If a string contains any RandALCat character, the string
		# MUST NOT contain any LCat character.
		ifany(stringprep.in_table_d2(x)forxinlabel):
		raiseUnicodeError("Violation of BIDI requirement 2")

		# 3) If a string contains any RandALCat character, a
		# RandALCat character MUST be the first character of the
		# string, and a RandALCat character MUST be the last
		# character of the string.
		ifnotRandAL[0]ornotRandAL[-1]:
		raiseUnicodeError("Violation of BIDI requirement 3")
		ifany(RandAL):
		# There is a RandAL char in the string. Must perform further
		# tests:
		# 1) The characters in section 5.8 MUST be prohibited.
		# This is table C.8, which was already checked
		# 2) If a string contains any RandALCat character, the string
		# MUST NOT contain any LCat character.
		ifany(stringprep.in_table_d2(x)forxinlabel):
		raiseUnicodeError("Violation of BIDI requirement 2")
		# 3) If a string contains any RandALCat character, a
		# RandALCat character MUST be the first character of the
		# string, and a RandALCat character MUST be the last
		# character of the string.
		ifnotRandAL[0]ornotRandAL[-1]:
		raiseUnicodeError("Violation of BIDI requirement 3")

		returnlabel

Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1532,6 +1532,12 @@ def test_builtin_encode(self):
		self.assertEqual("pyth\xf6n.org".encode("idna"), b"xn--pythn-mua.org")
		self.assertEqual("pyth\xf6n.org.".encode("idna"), b"xn--pythn-mua.org.")

		def test_builtin_decode_length_limit(self):
		with self.assertRaisesRegex(UnicodeError, "too long"):
		(b"xn--016c"+b"a"*1100).decode("idna")
		with self.assertRaisesRegex(UnicodeError, "too long"):
		(b"xn--016c"+b"a"*70).decode("idna")

		def test_stream(self):
		r = codecs.getreader("idna")(io.BytesIO(b"abc"))
		r.read(3)
Expand Down
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,6 @@
		The IDNA codec decoder used on DNS hostnames by:mod:`socket` or:mod:`asyncio`
		related name resolution functions no longer involves a quadratic algorithm.
		This prevents a potential CPU denial of service if an out-of-spec excessive
		length hostname involving bidirectional characters were decoded. Some protocols
		such as:mod:`urllib` http ``3xx`` redirects potentially allow for an attacker
		to supply such a name.