Re: Add support for IDNA 2008

OK, great, thanks. I'll await your PR. Let's continue on GitHub for the moment then Good hustle 👍 On Wed, 14 Sept 2022 at 15:54, 'Julien Bernard' via Django developers (Contributions to Django itself) wrote: > Hi Carlton, > > Le mardi 13 septembre 2022 à 07:17:31 UTC-4, carlton...@gmail.com a >

Re: Add support for IDNA 2008

Hi Carlton, Le mardi 13 septembre 2022 à 07:17:31 UTC-4, carlton...@gmail.com a écrit : > Hi Julien. > > I didn't get a canonical answer from the security team yet, but it may be > that we can make the idna an optional dependency quite easily. I already > have it installed in my dev environmen

Re: Add support for IDNA 2008

Hi Julien. I didn't get a canonical answer from the security team yet, but it may be that we can make the idna an optional dependency quite easily. I already have it installed in my dev environment, for instance, coming from selenium and requests. >From the package docs: https://pypi.org/pro

Re: Add support for IDNA 2008

Hey Julien. Thanks, OK... 📖 The Python docs have it : > If you need the IDNA 2008 standard from *RFC 5891* and *RFC 5895* , use the th

Re: Add support for IDNA 2008

Hi Carlton, IDNA 2008 made some changes in the valid or invalid IDNs and some differences in the ways some characters are transformed in Punycode compared to IDNA 2003 for multiple reasons. A difference that is often used as an example is the german 'ß' character. In IDNA 2003 it is transformed

Re: Add support for IDNA 2008

Hey Julian. What's maybe missing is some concrete cases. "This conversion should be made IDNA 2008 compliant." — OK, but what does that buy us? Maybe the idna package is OK... It's widely depended on already — I got it for free yesterday installing httpx in a project — and packaging isn't what it

Re: Add support for IDNA 2008

Thanks Carlton. This makes total sense to keep things simple and avoid bringing another dependency in the context of validation, providing that you won't prevent valid URLs to be accepted. That's where it can be tricky but it seems reasonable to think that the current domain validation is too

Re: Add support for IDNA 2008

Hi Julian. We've had several tickets and discussions surrounding how far e.g. URLValidator needs to match all valid URLs. The conclusion we've come to (which is always provisional) is that actually we **don't** want such match all valid (according to the relevant RFC and such) input. Rather, we'd

Re: Add support for IDNA 2008

Thanks Adam. The ticket was targetting EmailValidator but the punycode method is used at more places in Django core. If you look for Unicode characters support in email addresses in tickets you will get more than looking for IDN but indeed the demand may not be that much. This is a vicious circl

Re: Add support for IDNA 2008

Some data... The idna package has ~9M downloads a day ( https://pypistats.org/packages/idna ) compared with Django's ~350k ( https://pypistats.org/packages/django ). However it has 191 GitHub stars ( https://github.com/kjd/idna ) compared to Django's 66k ( https://github.com/django/django ). I i

Add support for IDNA 2008

Hi, I'm starting this discussion following ticket #33968 recommendation in comment. Currently the punycode method is converting domain nam