[3.12] gh-155292: Don't consider Unicode codepoint attributes outside RFC 3454 (GH-155293) (GH-156020) (#156930)

Due to a bug, some Unicode codepoint attributes were considered
for characters not yet defined in Unicode 3.2.0 or attributes
which changed in later Unicode versions. RFC 3454 (StringPrep)
requires using Unicode 3.2.0 strictly.

(cherry picked from commit 7e109d0)
The cherry-pick needed reworking as GH-144815 wasn't backported to 3.14
and below, so unassigned characters don't have bidi values.
(cherry picked from commit 1e54caa)
Also, add Unicode_3_2_0_FunctionsTest as in the later versions,
to make the new test work.

Co-authored-by: Seth Larson seth@python.org
Co-authored-by: Stan Ulbrych 89152624+stanfromireland@users.noreply.github.com
Co-authored-by: Petr Viktorin encukou@gmail.com

Author: encukou

Lib/stringprep.py

@@ -1569,6 +1569,15 @@ def test_builtin_encode(self):
         self.assertEqual("pyth\xf6n.org".encode("idna"), b"xn--pythn-mua.org")
         self.assertEqual("pyth\xf6n.org.".encode("idna"), b"xn--pythn-mua.org.")
 
+    @support.subTests(['unicode', 'encoded'], [
+        ('\N{CHEROKEE LETTER A}\N{CHEROKEE LETTER A}', b"xn--58da"),
+        ('\N{GEORGIAN CAPITAL LETTER AN}.', b"xn--7md."),
+        ('\N{CYRILLIC LETTER PALOCHKA}.example', b"xn--d5a.example"),
+        ('\N{ROMAN NUMERAL REVERSED ONE HUNDRED}.example.', b"xn--q5g.example."),
+    ])
+    def test_new_unicode_case_folding(self, unicode, encoded):
+        self.assertEqual(unicode.encode("idna"), encoded)
+
     def test_builtin_decode_length_limit(self):
         with self.assertRaisesRegex(UnicodeError, "way too long"):
             (b"xn--016c"+b"a"*1100).decode("idna")

Lib/test/test_codecs.py

@@ -68,6 +68,7 @@ class UnicodeDatabaseTest(unittest.TestCase):
     db = unicodedata
 
 class UnicodeFunctionsTest(UnicodeDatabaseTest):
+    old = False
 
     # Update this if the database changes. Make sure to do a full rebuild
     # (e.g. 'make distclean && make') to get the correct checksum.
@@ -95,7 +96,8 @@ def test_function_checksum(self):
             ]
             h.update(''.join(data).encode("ascii"))
         result = h.hexdigest()
-        self.assertEqual(result, self.expectedchecksum)
+        if not self.old:
+            self.assertEqual(result, self.expectedchecksum)
 
     @requires_resource('cpu')
     def test_name_inverse_lookup(self):
@@ -121,9 +123,13 @@ def test_numeric(self):
         self.assertEqual(self.db.numeric('9'), 9)
         self.assertEqual(self.db.numeric('\u215b'), 0.125)
         self.assertEqual(self.db.numeric('\u2468'), 9.0)
-        self.assertEqual(self.db.numeric('\ua627'), 7.0)
+        # New in 5.1.0
+        self.assertEqual(self.db.numeric('\ua627', None),
+                         None if self.old else 7.0)
         self.assertEqual(self.db.numeric('\U00020000', None), None)
-        self.assertEqual(self.db.numeric('\U0001012A'), 9000)
+        # New in 4.1.0
+        self.assertEqual(self.db.numeric('\U0001012A', None),
+                         None if self.old else 9000)
 
         self.assertRaises(TypeError, self.db.numeric)
         self.assertRaises(TypeError, self.db.numeric, 'xx')
@@ -146,7 +152,8 @@ def test_category(self):
         self.assertEqual(self.db.category('a'), 'Ll')
         self.assertEqual(self.db.category('A'), 'Lu')
         self.assertEqual(self.db.category('\U00020000'), 'Lo')
-        self.assertEqual(self.db.category('\U0001012A'), 'No')
+        self.assertEqual(self.db.category('\U0001012A'),
+                         'Cn' if self.old else 'No')
 
         self.assertRaises(TypeError, self.db.category)
         self.assertRaises(TypeError, self.db.category, 'xx')
@@ -160,6 +167,15 @@ def test_bidirectional(self):
         self.assertRaises(TypeError, self.db.bidirectional)
         self.assertRaises(TypeError, self.db.bidirectional, 'xx')
 
+    def test_bidirectional_unassigned(self):
+        self.assertEqual(self.db.bidirectional('\u0378'), '')
+        self.assertEqual(self.db.bidirectional('\u077F'), '' if self.old else 'AL')
+        self.assertEqual(self.db.bidirectional('\u20CF'), '')
+        self.assertEqual(self.db.bidirectional('\u0590'), '')
+        self.assertEqual(self.db.bidirectional('\uFFFF'), '')
+        self.assertEqual(self.db.bidirectional('\U0001FFFE'), '')
+        self.assertEqual(self.db.bidirectional('\U00010D01'), '' if self.old else 'AL')
+
     def test_decomposition(self):
         self.assertEqual(self.db.decomposition('\uFFFE'),'')
         self.assertEqual(self.db.decomposition('\u00bc'), '<fraction> 0031 2044 0034')
@@ -275,8 +291,14 @@ def test_east_asian_width_unassigned(self):
             self.assertIs(self.db.name(char, None), None)
 
     def test_east_asian_width_9_0_changes(self):
-        self.assertEqual(self.db.ucd_3_2_0.east_asian_width('\u231a'), 'N')
-        self.assertEqual(self.db.east_asian_width('\u231a'), 'W')
+        self.assertEqual(self.db.east_asian_width('\u231a'),
+                         'N' if self.old else 'W')
+
+
+class Unicode_3_2_0_FunctionsTest(UnicodeFunctionsTest):
+    db = unicodedata.ucd_3_2_0
+    old = True
+
 
 class UnicodeMiscTest(UnicodeDatabaseTest):
 

Lib/test/test_unicodedata.py

@@ -0,0 +1,2 @@
+Change the :mod:`stringprep` module and :mod:`encodings.idna` codec to not
+consider Unicode codepoint attributes beyond those defined in :rfc:`3454`.

Misc/NEWS.d/next/Security/2026-08-06-11-43-20.gh-issue-155292.j4pHBO.rst

@@ -28,6 +28,7 @@
 
 import dataclasses
 import os
+import subprocess
 import sys
 import zipfile
 
@@ -130,6 +131,7 @@ def maketables(trace=0):
     makeunicodename(unicode, trace)
     makeunicodedata(unicode, trace)
     makeunicodetype(unicode, trace)
+    makestringprep()
 
 
 # --------------------------------------------------------------------
@@ -814,6 +816,19 @@ def word_key(a):
         fprint('};')
 
 
+
+def makestringprep():
+    FILE = "Lib/stringprep.py"
+
+    print("--- Preparing", FILE, "...")
+
+    MKSTRINGPREP = "Tools/unicode/mkstringprep.py"
+
+    with open(FILE, "w") as f:
+        f.truncate()
+        subprocess.check_call([sys.executable, MKSTRINGPREP], stdout=f)
+
+
 def merge_old_version(version, new, old):
     # Changes to exclusion file not implemented yet
     if old.exclusions != new.exclusions:

Tools/unicode/makeunicodedata.py

@@ -1,15 +1,20 @@
 import re
-from unicodedata import ucd_3_2_0 as unicodedata
+import os
+import unicodedata as unicodedata_current
+from unicodedata import ucd_3_2_0 as unicodedata_320
+
+FILENAME = "Tools/unicode/data/rfc3454.txt"
+URL = "https://www.rfc-editor.org/rfc/rfc3454.txt"
 
 def gen_category(cats):
     for i in range(0, 0x110000):
-        if unicodedata.category(chr(i)) in cats:
-            yield(i)
+        if unicodedata_320.category(chr(i)) in cats:
+            yield i
 
 def gen_bidirectional(cats):
     for i in range(0, 0x110000):
-        if unicodedata.bidirectional(chr(i)) in cats:
-            yield(i)
+        if unicodedata_320.bidirectional(chr(i)) in cats:
+            yield i
 
 def compact_set(l):
     single = []
@@ -47,8 +52,16 @@ def compact_set(l):
 
 ############## Read the tables in the RFC #######################
 
-with open("rfc3454.txt") as f:
-    data = f.readlines()
+try:
+    data_file = open(FILENAME, encoding='utf-8')
+except FileNotFoundError:
+    import urllib.request
+    os.makedirs(os.path.dirname(FILENAME), exist_ok=True)
+    urllib.request.urlretrieve(URL, filename=FILENAME)
+    data_file = open(FILENAME, encoding='utf-8')
+
+with data_file:
+    data = data_file.readlines()
 
 tables = []
 curname = None
@@ -116,10 +129,18 @@ def compact_set(l):
 and mappings, for which a mapping function is provided.
 \"\"\"
 
-from unicodedata import ucd_3_2_0 as unicodedata
+# This check asserts that mkstringprep.py has been run
+# when unicodedata is modified to ensure conformant behavior.
+import unicodedata
+""")
+
+print("assert unicodedata.unidata_version == %r" % (unicodedata_current.unidata_version,))
+
+print("""
+from unicodedata import ucd_3_2_0 as unicodedata_320
 """)
 
-print("assert unicodedata.unidata_version == %r" % (unicodedata.unidata_version,))
+print("assert unicodedata_320.unidata_version == %r" % (unicodedata_320.unidata_version,))
 
 # A.1 is the table of unassigned characters
 # XXX Plane 15 PUA is listed as unassigned in Python.
@@ -139,7 +160,7 @@ def compact_set(l):
 
 print("""
 def in_table_a1(code):
-    if unicodedata.category(code) != 'Cn': return False
+    if unicodedata_320.category(code) != 'Cn': return False
     c = ord(code)
     if 0xFDD0 <= c < 0xFDF0: return False
     return (c & 0xFFFF) not in (0xFFFE, 0xFFFF)
@@ -172,21 +193,33 @@ def in_table_b1(code):
 
 # B.3 is mostly Python's .lower, except for a number
 # of special cases, e.g. considering canonical forms.
+# To enforce Unicode 3.2.0 behavior of .lower instead of
+# whatever Unicode version is included with Python we
+# add unassigned or newly case-folding codepoints to
+# the exception map, too.
 
 b3_exceptions = {}
 
 for k,v in table_b2.items():
     if list(map(ord, chr(k).lower())) != v:
         b3_exceptions[k] = "".join(map(chr,v))
+for cp in range(0x110000):
+    ch = chr(cp)
+    # Assigned in current Unicode version
+    # and supports case folding, but not
+    # explicitly in B.2 or B.3 tables.
+    if (unicodedata_current.category(ch) != "Cn"
+            and ch.lower() != ch
+            and cp not in table_b2
+            and cp not in table_b3):
+        b3_exceptions[cp] = ch  # Identity.
 
 b3 = sorted(b3_exceptions.items())
 
 print("""
 b3_exceptions = {""")
 for i, kv in enumerate(b3):
-    print("0x%x:%a," % kv, end=' ')
-    if i % 4 == 3:
-        print()
+    print("0x%x:%a," % kv, end='\n' if i % 4 == 3 else ' ')
 print("}")
 
 print("""
@@ -207,9 +240,9 @@ def map_table_b3(code):
 
 def map_table_b2(a):
     al = map_table_b3(a)
-    b = unicodedata.normalize("NFKC", al)
+    b = unicodedata_320.normalize("NFKC", al)
     bl = "".join([map_table_b3(ch) for ch in b])
-    c = unicodedata.normalize("NFKC", bl)
+    c = unicodedata_320.normalize("NFKC", bl)
     if b != c:
         return c
     else:
@@ -226,9 +259,9 @@ def map_table_b2(a):
 print("""
 def map_table_b2(a):
     al = map_table_b3(a)
-    b = unicodedata.normalize("NFKC", al)
+    b = unicodedata_320.normalize("NFKC", al)
     bl = "".join([map_table_b3(ch) for ch in b])
-    c = unicodedata.normalize("NFKC", bl)
+    c = unicodedata_320.normalize("NFKC", bl)
     if b != c:
         return c
     else:
@@ -251,16 +284,16 @@ def in_table_c11(code):
 del tables[0]
 assert name == "C.1.2"
 
-# table = set(table.keys())
-# Zs = set(gen_category(["Zs"])) - {0x20}
-# assert Zs == table
+table = set(table.keys())
+Zs = set(gen_category(["Zs"])) - {0x20}
+assert Zs == table
 
 print("""
 def in_table_c12(code):
-    return unicodedata.category(code) == "Zs" and code != " "
+    return unicodedata_320.category(code) == "Zs" and code != " "
 
 def in_table_c11_c12(code):
-    return unicodedata.category(code) == "Zs"
+    return unicodedata_320.category(code) == "Zs"
 """)
 
 # C.2.1 ASCII control characters
@@ -275,7 +308,7 @@ def in_table_c11_c12(code):
 
 print("""
 def in_table_c21(code):
-    return ord(code) < 128 and unicodedata.category(code) == "Cc"
+    return ord(code) < 128 and unicodedata_320.category(code) == "Cc"
 """)
 
 # C.2.2 Non-ASCII control characters. It also includes
@@ -295,11 +328,11 @@ def in_table_c21(code):
 def in_table_c22(code):
     c = ord(code)
     if c < 128: return False
-    if unicodedata.category(code) == "Cc": return True
+    if unicodedata_320.category(code) == "Cc": return True
     return c in c22_specials
 
 def in_table_c21_c22(code):
-    return unicodedata.category(code) == "Cc" or \\
+    return unicodedata_320.category(code) == "Cc" or \\
            ord(code) in c22_specials
 """)
 
@@ -313,7 +346,7 @@ def in_table_c21_c22(code):
 
 print("""
 def in_table_c3(code):
-    return unicodedata.category(code) == "Co"
+    return unicodedata_320.category(code) == "Co"
 """)
 
 # C.4 Non-character code points, xFFFE, xFFFF
@@ -346,7 +379,7 @@ def in_table_c4(code):
 
 print("""
 def in_table_c5(code):
-    return unicodedata.category(code) == "Cs"
+    return unicodedata_320.category(code) == "Cs"
 """)
 
 # C.6 Inappropriate for plain text
@@ -411,7 +444,7 @@ def in_table_c9(code):
 
 print("""
 def in_table_d1(code):
-    return unicodedata.bidirectional(code) in ("R","AL")
+    return unicodedata_320.bidirectional(code) in ("R","AL")
 """)
 
 # D.2 Characters with bidirectional property "L"
@@ -424,5 +457,5 @@ def in_table_d1(code):
 
 print("""
 def in_table_d2(code):
-    return unicodedata.bidirectional(code) == "L"
-""")
+    return unicodedata_320.bidirectional(code) == "L"
+""", end="")