Comments on: IDNA flaws with regard to U+2024 http://blog.josefsson.org/2008/01/14/idna-flaws-with-regard-to-u2024/ Sun, 14 Mar 2010 12:31:36 +0000 http://wordpress.org/?v=2.7.1 hourly 1 By: http://josefsson.org/ http://blog.josefsson.org/2008/01/14/idna-flaws-with-regard-to-u2024/comment-page-1/#comment-2715 http://josefsson.org/ Mon, 14 Jan 2008 16:48:34 +0000 http://blog.josefsson.org/2008/01/14/idna-flaws-with-regard-to-u2024/#comment-2715 For what it's worth, I tend to agree with Erik that RFC 3490 probably didn't intend for ToASCII to be able to output U+002E's in the middle of a label. Alas, the intent and words doesn't match. For what it’s worth, I tend to agree with Erik that RFC 3490 probably didn’t intend for ToASCII to be able to output U+002E’s in the middle of a label. Alas, the intent and words doesn’t match.

]]> By: http://josefsson.org/ http://blog.josefsson.org/2008/01/14/idna-flaws-with-regard-to-u2024/comment-page-1/#comment-2714 http://josefsson.org/ Mon, 14 Jan 2008 16:24:22 +0000 http://blog.josefsson.org/2008/01/14/idna-flaws-with-regard-to-u2024/#comment-2714 I've tested Safari on Mac OS X, and it behaves like libidn here. I’ve tested Safari on Mac OS X, and it behaves like libidn here.

]]> By: Erik van der Poel http://blog.josefsson.org/2008/01/14/idna-flaws-with-regard-to-u2024/comment-page-1/#comment-2713 Erik van der Poel Mon, 14 Jan 2008 16:02:33 +0000 http://blog.josefsson.org/2008/01/14/idna-flaws-with-regard-to-u2024/#comment-2713 RFC 3490 section 4 steps 4) and 5) would seem to indicate that the ToASCII'd labels are recombined, inserting U+002E between each pair of labels. Presumably, the recombined domain name is then looked up (resolved) using gethostbyname() or whatever, so the U+002E's that were produced by NFKC in the Nameprep step then become label separators. In other words, I don't think RFC 3490 intended this weird NFKC/dot issue to become some backhanded way to get 0x2E into a DNS packet a la RFC 1035's \. syntax (escaped dot). RFC 3490 section 4 steps 4) and 5) would seem to indicate that the ToASCII’d labels are recombined, inserting U+002E between each pair of labels. Presumably, the recombined domain name is then looked up (resolved) using gethostbyname() or whatever, so the U+002E’s that were produced by NFKC in the Nameprep step then become label separators.

In other words, I don’t think RFC 3490 intended this weird NFKC/dot issue to become some backhanded way to get 0×2E into a DNS packet a la RFC 1035’s \. syntax (escaped dot).

]]>