Message 411535 - Python tracker

➜

This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Author	gregory.p.smith
Recipients	gregory.p.smith
Date	2022-01-25.00:12:22
SpamBayes Score	-1.0
Marked as misclassified	Yes
Message-id	<1643069542.61.0.619122428664.issue46508@roundup.psfhosted.org>
In-reply-to

Content
in 3.8 this was not a valid codec name: "เ_เ_เ_iDnA" in 3.9 it gets treated as idna and triggers the punycode decoder when passed to bytes.decode(codec). Discovered by oss-fuzz. _Likely_ a consequence of https://bugs.python.org/issue37751 The consequences of this change are that anyone can stuff heinous strings into codec names and get a non-LookupError behavior out of them. Anywhere codecs can be part of user input this has many interesting potential negative consequences. <=3.8 gave `LookupError("unknown encoding: ...`

in 3.8 this was not a valid codec name: "เ_เ_เ_iDnA"
in 3.9 it gets treated as idna and triggers the punycode decoder when passed to bytes.decode(codec).

Discovered by oss-fuzz.

_Likely_ a consequence of https://bugs.python.org/issue37751

The consequences of this change are that anyone can stuff heinous strings into codec names and get a non-LookupError behavior out of them. Anywhere codecs can be part of user input this has many interesting potential negative consequences.

<=3.8 gave `LookupError("unknown encoding: ...`

History
Date	User	Action	Args
2022-01-25 00:12:22	gregory.p.smith	set	recipients: + gregory.p.smith
2022-01-25 00:12:22	gregory.p.smith	set	messageid: <1643069542.61.0.619122428664.issue46508@roundup.psfhosted.org>
2022-01-25 00:12:22	gregory.p.smith	link	issue46508 messages
2022-01-25 00:12:22	gregory.p.smith	create