Unicode collision: stringprep, saslprep

mozilla / unicode-slugify

A slugifier that works in unicode

BSD 3-Clause "New" or "Revised" License

320 stars 53 forks source link

Unicode collision: stringprep, saslprep #7

Open westurner opened 11 years ago

westurner commented 11 years ago

The stringprep routines in passlib.utils.saslprep may be relevant to some of the usecases for unicode-slugify.

References

http://www.reddit.com/r/programming/comments/1gl0zn/a_security_hole_via_unicode_usernames/cali4b9
http://www.reddit.com/r/Python/comments/1higug/the_updated_guide_to_unicode_on_python_armin/cav3rxd

nitely commented 6 years ago

Everything described by rfc4013 (Stringprep) seems to be covered by slugify. It does NFKC (normalization form into compatibility decomposition + canonical composition), then keeps characters defined as letter or number by the unicode character database (so, no invisible characters).

That said, why anyone would use unicode for usernames is beyond me. There are plenty of chars that look alike.