golang / go

The Go programming language
https://go.dev
BSD 3-Clause "New" or "Revised" License
122.86k stars 17.52k forks source link

x/text/secure/bidirule: label starting with EN UTF8 property should be invalid #21694

Open szank opened 7 years ago

szank commented 7 years ago

Please answer these questions before submitting your issue. Thanks!

What version of Go are you using (go version)?

go version go1.9 darwin/amd64

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

GOARCH="amd64" GOBIN="" GOEXE="" GOHOSTARCH="amd64" GOHOSTOS="darwin" GOOS="darwin" GOPATH="/Users/mgalkowski/work/go" GORACE="" GOROOT="/usr/local/Cellar/go/1.9/libexec" GOTOOLDIR="/usr/local/Cellar/go/1.9/libexec/pkg/tool/darwin_amd64" GCCGO="gccgo" CC="clang" GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/cs/93b4_xbx4l5gn1wx0f69p3d40000gn/T/go-build033566806=/tmp/go-build -gno-record-gcc-switches -fno-common" CXX="clang++" CGO_ENABLED="1" CGO_CFLAGS="-g -O2" CGO_CPPFLAGS="" CGO_CXXFLAGS="-g -O2" CGO_FFLAGS="-g -O2" CGO_LDFLAGS="-g -O2" PKG_CONFIG="pkg-config"

What did you do?

If possible, provide a recipe for reproducing the error. A complete runnable program is good.

package main

import (
    "fmt"

    "golang.org/x/text/secure/bidirule"
)

func main() {
    var invalidLabel = "0aaaa"
    var invalidLabelEscaped = "\u0030aaaaa"

    fmt.Println(bidirule.ValidString(invalidLabel))
    fmt.Println(bidirule.ValidString(invalidLabelEscaped))
}

What did you expect to see?

false
false

What did you see instead?

true 
true

According to RFC 5893:

The first character must be a character with Bidi property L, R,
       or AL.  If it has the R or AL property, it is an RTL label; if it
       has the L property, it is an LTR label.

0 (\u0030) have EN (european number) property, to it is not allowed at the beginning of the label. This package is not conformant with the BIDI RFC.

szank commented 7 years ago

Sigh, I might have been to hasty with this. If I am reading the RFC correctly, then the BIDI rules are enforced only if the domain name contains RTL characters.

If someone can confirm this, then please close this bug report as invalid.