Don't consider Unicode codepoint attributes outside RFC 3454

Due to a bug, some Unicode codepoint attributes were considered
for characters not yet defined in Unicode 3.2.0 or attributes
which changed in later Unicode versions. RFC 3454 (StringPrep)
requires using Unicode 3.2.0 strictly.

Co-authored-by: Stan Ulbrych <89152624+stanfromireland@users.noreply.github.com>

Author: sethmlarson

Lib/stringprep.py

@@ -1695,6 +1695,12 @@ def test_builtin_encode(self):
         self.assertEqual("pyth\xf6n.org".encode("idna"), b"xn--pythn-mua.org")
         self.assertEqual("pyth\xf6n.org.".encode("idna"), b"xn--pythn-mua.org.")
 
+    def test_new_unicode_case_folding(self):
+        self.assertEqual("ᎠᎠ".encode("idna"), b"xn--58da")
+        self.assertEqual("Ⴀ.".encode("idna"), b"xn--7md.")
+        self.assertEqual("Ӏ.example".encode("idna"), b"xn--d5a.example")
+        self.assertEqual("Ↄ.example.".encode("idna"), b"xn--q5g.example.")
+
     def test_builtin_encode_invalid(self):
         for case, expected in self.invalid_encode_testcases:
             with self.subTest(case=case, expected=expected):

Lib/test/test_codecs.py

@@ -321,7 +321,7 @@ def test_category(self):
         self.assertRaises(TypeError, self.db.category, 'xx')
 
     def test_bidirectional(self):
-        self.assertEqual(self.db.bidirectional('\uFFFE'), 'BN')
+        self.assertEqual(self.db.bidirectional('\uFFFE'), '' if self.old else 'BN')
         self.assertEqual(self.db.bidirectional(' '), 'WS')
         self.assertEqual(self.db.bidirectional('A'), 'L')
         self.assertEqual(self.db.bidirectional('\U00020000'), 'L')
@@ -350,15 +350,13 @@ def test_bidirectional(self):
         self.assertRaises(TypeError, self.db.bidirectional, 'xx')
 
     def test_bidirectional_unassigned(self):
-        if self.old:
-            return
-        self.assertEqual(self.db.bidirectional('\u0378'), 'L')
-        self.assertEqual(self.db.bidirectional('\u077F'), 'AL')
-        self.assertEqual(self.db.bidirectional('\u20CF'), 'ET')
-        self.assertEqual(self.db.bidirectional('\u0590'), 'R')
-        self.assertEqual(self.db.bidirectional('\uFFFF'), 'BN')
-        self.assertEqual(self.db.bidirectional('\U0001FFFE'), 'BN')
-        self.assertEqual(self.db.bidirectional('\U00010D01'), 'AL')
+        self.assertEqual(self.db.bidirectional('\u0378'), '' if self.old else 'L')
+        self.assertEqual(self.db.bidirectional('\u077F'), '' if self.old else 'AL')
+        self.assertEqual(self.db.bidirectional('\u20CF'), '' if self.old else 'ET')
+        self.assertEqual(self.db.bidirectional('\u0590'), '' if self.old else 'R')
+        self.assertEqual(self.db.bidirectional('\uFFFF'), '' if self.old else 'BN')
+        self.assertEqual(self.db.bidirectional('\U0001FFFE'), '' if self.old else 'BN')
+        self.assertEqual(self.db.bidirectional('\U00010D01'), '' if self.old else 'AL')
 
     def test_decomposition(self):
         self.assertEqual(self.db.decomposition('\uFFFE'),'')
@@ -1104,9 +1102,9 @@ def test_block_invalid_input(self):
 class Unicode_3_2_0_FunctionsTest(unittest.TestCase, BaseUnicodeFunctionsTest):
     db = unicodedata.ucd_3_2_0
     old = True
-    expectedchecksum = ('cb5bbbd1f55b67371e18222b90a8e21c87f16b72'
+    expectedchecksum = ('883824cb6c0ccf994e4451ebf281e2d6d479af47'
                         if quicktest else
-                        '74936dffe949d99203a47e6a66565b2fc337bae7')
+                        '68cd01e2c680b851c1fcab012efb5635b2229c2b')
 
 
 class UnicodeMiscTest(unittest.TestCase):

Lib/test/test_unicodedata.py

@@ -0,0 +1,2 @@
+Change the :mod:`stringprep` module and :mod:`encoding.idna` codec to not
+consider Unicode codepoint attributes beyond those defined in :rfc:`3454`.

Misc/NEWS.d/next/Security/2026-08-06-11-43-20.gh-issue-155292.j4pHBO.rst

@@ -28,6 +28,7 @@
 
 import dataclasses
 import os
+import subprocess
 import sys
 import re
 import zipfile
@@ -169,6 +170,7 @@ def maketables(trace=0):
     makeunicodename(unicode, trace)
     makeunicodedata(unicode, trace)
     makeunicodetype(unicode, trace)
+    makestringprep()
 
 
 # --------------------------------------------------------------------
@@ -810,6 +812,19 @@ def makeunicodename(unicode, trace):
             fprint('    "%s",' % prefix)
         fprint('};')
 
+
+def makestringprep():
+    FILE = "Lib/stringprep.py"
+
+    print("--- Preparing", FILE, "...")
+
+    MKSTRINGPREP = "Tools/unicode/mkstringprep.py"
+
+    with open(FILE, "w") as f:
+        f.truncate()
+        subprocess.check_call([sys.executable, MKSTRINGPREP], stdout=f)
+
+
 def merge_old_version(version, new, old):
     # Changes to exclusion file not implemented yet
     if old.exclusions != new.exclusions:
@@ -831,6 +846,10 @@ def merge_old_version(version, new, old):
             # Characters unassigned in the new version ought to
             # be unassigned in the old one
             assert old.table[i] is None
+            # Without a change record the old view would fall
+            # through to the new default, so record the old value
+            if old.bidi_classes[i] != new.bidi_classes[i]:
+                bidir_changes[i] = BIDIRECTIONAL_NAMES.index(old.bidi_classes[i] or '')
             continue
         # check characters unassigned in the old version
         if old.table[i] is None:

Modules/unicodedata_db.h

@@ -1,15 +1,16 @@
 import re
-from unicodedata import ucd_3_2_0 as unicodedata
+import unicodedata as unicodedata_current
+from unicodedata import ucd_3_2_0 as unicodedata_320
 
 def gen_category(cats):
     for i in range(0, 0x110000):
-        if unicodedata.category(chr(i)) in cats:
-            yield(i)
+        if unicodedata_320.category(chr(i)) in cats:
+            yield i
 
 def gen_bidirectional(cats):
     for i in range(0, 0x110000):
-        if unicodedata.bidirectional(chr(i)) in cats:
-            yield(i)
+        if unicodedata_320.bidirectional(chr(i)) in cats:
+            yield i
 
 def compact_set(l):
     single = []
@@ -116,10 +117,18 @@ def compact_set(l):
 and mappings, for which a mapping function is provided.
 \"\"\"
 
-from unicodedata import ucd_3_2_0 as unicodedata
+# This check asserts that mkstringprep.py has been run
+# when unicodedata is modified to ensure conformant behavior.
+import unicodedata
 """)
 
-print("assert unicodedata.unidata_version == %r" % (unicodedata.unidata_version,))
+print("assert unicodedata.unidata_version == %r" % (unicodedata_current.unidata_version,))
+
+print("""
+from unicodedata import ucd_3_2_0 as unicodedata_320
+""")
+
+print("assert unicodedata_320.unidata_version == %r" % (unicodedata_320.unidata_version,))
 
 # A.1 is the table of unassigned characters
 # XXX Plane 15 PUA is listed as unassigned in Python.
@@ -139,7 +148,7 @@ def compact_set(l):
 
 print("""
 def in_table_a1(code):
-    if unicodedata.category(code) != 'Cn': return False
+    if unicodedata_320.category(code) != 'Cn': return False
     c = ord(code)
     if 0xFDD0 <= c < 0xFDF0: return False
     return (c & 0xFFFF) not in (0xFFFE, 0xFFFF)
@@ -172,21 +181,33 @@ def in_table_b1(code):
 
 # B.3 is mostly Python's .lower, except for a number
 # of special cases, e.g. considering canonical forms.
+# To enforce Unicode 3.2.0 behavior of .lower instead of
+# whatever Unicode version is included with Python we
+# add unassigned or newly case-folding codepoints to
+# the exception map, too.
 
 b3_exceptions = {}
 
 for k,v in table_b2.items():
     if list(map(ord, chr(k).lower())) != v:
         b3_exceptions[k] = "".join(map(chr,v))
+for cp in range(0x110000):
+    ch = chr(cp)
+    # Assigned in current Unicode version
+    # and supports case folding, but not
+    # explicitly in B.2 or B.3 tables.
+    if (unicodedata_current.category(ch) != "Cn"
+            and ch.lower() != ch
+            and cp not in table_b2
+            and cp not in table_b3):
+        b3_exceptions[cp] = ch  # Identity.
 
 b3 = sorted(b3_exceptions.items())
 
 print("""
 b3_exceptions = {""")
 for i, kv in enumerate(b3):
-    print("0x%x:%a," % kv, end=' ')
-    if i % 4 == 3:
-        print()
+    print("0x%x:%a," % kv, end='\n' if i % 4 == 3 else ' ')
 print("}")
 
 print("""
@@ -207,9 +228,9 @@ def map_table_b3(code):
 
 def map_table_b2(a):
     al = map_table_b3(a)
-    b = unicodedata.normalize("NFKC", al)
+    b = unicodedata_320.normalize("NFKC", al)
     bl = "".join([map_table_b3(ch) for ch in b])
-    c = unicodedata.normalize("NFKC", bl)
+    c = unicodedata_320.normalize("NFKC", bl)
     if b != c:
         return c
     else:
@@ -226,9 +247,9 @@ def map_table_b2(a):
 print("""
 def map_table_b2(a):
     al = map_table_b3(a)
-    b = unicodedata.normalize("NFKC", al)
+    b = unicodedata_320.normalize("NFKC", al)
     bl = "".join([map_table_b3(ch) for ch in b])
-    c = unicodedata.normalize("NFKC", bl)
+    c = unicodedata_320.normalize("NFKC", bl)
     if b != c:
         return c
     else:
@@ -251,16 +272,16 @@ def in_table_c11(code):
 del tables[0]
 assert name == "C.1.2"
 
-# table = set(table.keys())
-# Zs = set(gen_category(["Zs"])) - {0x20}
-# assert Zs == table
+table = set(table.keys())
+Zs = set(gen_category(["Zs"])) - {0x20}
+assert Zs == table
 
 print("""
 def in_table_c12(code):
-    return unicodedata.category(code) == "Zs" and code != " "
+    return unicodedata_320.category(code) == "Zs" and code != " "
 
 def in_table_c11_c12(code):
-    return unicodedata.category(code) == "Zs"
+    return unicodedata_320.category(code) == "Zs"
 """)
 
 # C.2.1 ASCII control characters
@@ -275,7 +296,7 @@ def in_table_c11_c12(code):
 
 print("""
 def in_table_c21(code):
-    return ord(code) < 128 and unicodedata.category(code) == "Cc"
+    return ord(code) < 128 and unicodedata_320.category(code) == "Cc"
 """)
 
 # C.2.2 Non-ASCII control characters. It also includes
@@ -295,11 +316,11 @@ def in_table_c21(code):
 def in_table_c22(code):
     c = ord(code)
     if c < 128: return False
-    if unicodedata.category(code) == "Cc": return True
+    if unicodedata_320.category(code) == "Cc": return True
     return c in c22_specials
 
 def in_table_c21_c22(code):
-    return unicodedata.category(code) == "Cc" or \\
+    return unicodedata_320.category(code) == "Cc" or \\
            ord(code) in c22_specials
 """)
 
@@ -313,7 +334,7 @@ def in_table_c21_c22(code):
 
 print("""
 def in_table_c3(code):
-    return unicodedata.category(code) == "Co"
+    return unicodedata_320.category(code) == "Co"
 """)
 
 # C.4 Non-character code points, xFFFE, xFFFF
@@ -346,7 +367,7 @@ def in_table_c4(code):
 
 print("""
 def in_table_c5(code):
-    return unicodedata.category(code) == "Cs"
+    return unicodedata_320.category(code) == "Cs"
 """)
 
 # C.6 Inappropriate for plain text
@@ -411,7 +432,7 @@ def in_table_c9(code):
 
 print("""
 def in_table_d1(code):
-    return unicodedata.bidirectional(code) in ("R","AL")
+    return unicodedata_320.bidirectional(code) in ("R","AL")
 """)
 
 # D.2 Characters with bidirectional property "L"
@@ -424,5 +445,5 @@ def in_table_d1(code):
 
 print("""
 def in_table_d2(code):
-    return unicodedata.bidirectional(code) == "L"
+    return unicodedata_320.bidirectional(code) == "L"
 """)