From 3c2413d748cc41280eff56878a6b1d1bc9a66646 Mon Sep 17 00:00:00 2001
From: nandgator <38415384+nandgator@users.noreply.github.com>
Date: Thu, 22 Oct 2026 07:16:34 +0530
Subject: [PATCH] Reject IDNA-mapped lookalikes in domains and simple hostnames
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Python's idna codec implements IDNA 2003, whose nameprep step drops
invisible characters (soft hyphen, zero width space, joiners, variation
selectors), folds compatibility characters such as fullwidth letters,
the Kelvin sign or the long s to ASCII, and splits labels on U+3002 and
similar dots. domain() validated the mapped result, so "example.ｃｏｍ"
or "exam­ple.com" passed as example.com through domain(),
hostname(), url() and email().

Reject non-ASCII values that are not NFKC-stable or that contain
characters nameprep maps to nothing or treats as a dot. Internationalized
names that need no such mapping, such as "пример.рф" or "straße.de",
are still accepted.

The simple hostname regex used [a-z] with re.IGNORECASE, which also
matches U+0130, U+0131, U+017F and U+212A; add re.ASCII.
---
 src/validators/domain.py   | 20 ++++++++++++++++++++
 src/validators/hostname.py |  4 +++-
 tests/test_domain.py       | 36 ++++++++++++++++++++++++++++++++++++
 tests/test_email.py        |  6 ++++++
 tests/test_hostname.py     | 12 ++++++++++++
 tests/test_url.py          |  9 +++++++++
 6 files changed, 86 insertions(+), 1 deletion(-)

diff --git a/src/validators/domain.py b/src/validators/domain.py
index 1ce4a262..df0ebe59 100644
--- a/src/validators/domain.py
+++ b/src/validators/domain.py
@@ -4,7 +4,9 @@
 from os import environ
 from pathlib import Path
 import re
+from stringprep import in_table_b1
 from typing import Optional, Set
+from unicodedata import normalize
 
 # local
 from .utils import validator
@@ -37,6 +39,21 @@ def check(cls, tld: str):
         return tld in cls._full_cache
 
 
+def _relies_on_idna_mapping(value: str):
+    """Return whether `value` only becomes a valid name through IDNA 2003 mapping.
+
+    Python's `idna` codec implements IDNA 2003 (RFC 3490), whose nameprep step
+    (RFC 3491) drops invisible characters (RFC 3454, table B.1), folds
+    compatibility characters such as fullwidth letters to ASCII, and treats
+    U+3002 and similar dots as label separators. A value that needs any of
+    these only looks like the name it encodes to, e.g. "example.ｃｏｍ".
+    """
+    return not value.isascii() and (
+        normalize("NFKC", value) != value
+        or any(in_table_b1(char) or char in "\u3002\uff0e\uff61" for char in value)
+    )
+
+
 @validator
 def domain(
     value: str, /, *, consider_tld: bool = False, rfc_1034: bool = False, rfc_2782: bool = False
@@ -80,6 +97,9 @@ def domain(
         return False
 
     try:
+        if _relies_on_idna_mapping(value):
+            return False
+
         service_record = r"_" if rfc_2782 else ""
         trailing_dot = r"\.?$" if rfc_1034 else r"$"
 
diff --git a/src/validators/hostname.py b/src/validators/hostname.py
index ad415e13..e34ab7e4 100644
--- a/src/validators/hostname.py
+++ b/src/validators/hostname.py
@@ -26,7 +26,9 @@ def _simple_hostname_regex():
     """Simple hostname validation regex."""
     # {0,59} because two characters are already matched at
     # the beginning and at the end, making the range {1, 61}
-    return re.compile(r"^(?!-)[a-z0-9](?:[a-z0-9-]{0,59}[a-z0-9])?(?<!-)$", re.IGNORECASE)
+    return re.compile(
+        r"^(?!-)[a-z0-9](?:[a-z0-9-]{0,59}[a-z0-9])?(?<!-)$", re.IGNORECASE | re.ASCII
+    )
 
 
 def _port_validator(value: str):
diff --git a/tests/test_domain.py b/tests/test_domain.py
index d606ad79..9e655041 100644
--- a/tests/test_domain.py
+++ b/tests/test_domain.py
@@ -167,3 +167,39 @@ def test_returns_true_on_domain_within_rfc_length_limits(value: str):
 def test_returns_failed_validation_on_domain_beyond_rfc_limits(value: str):
     """Test returns failed validation on domain beyond RFC limits."""
     assert isinstance(domain(value), ValidationError)
+
+
+@pytest.mark.parametrize(
+    "value",
+    [
+        # IDNA 2003 maps these to "example.com"; see `_relies_on_idna_mapping`
+        "example.ｃｏｍ",  # fullwidth letters
+        "ｅｘａｍｐｌｅ.com",
+        "example.ⅽom",  # small roman numeral one hundred
+        "Kelvin.com",  # Kelvin sign
+        "ſhop.com",  # long s
+        "example。com",  # ideographic full stop
+        "example．com",  # fullwidth full stop
+        "example｡com",  # halfwidth ideographic full stop
+        "exam­ple.com",  # soft hyphen
+        "example.co​m",  # zero width space
+        "exa‍mple.com",  # zero width joiner
+        "exam️ple.com",  # variation selector
+        "examp⁠le.com",  # word joiner
+        "example.com",  # zero width no-break space
+        "exämple.com".replace("ä", "ä"),  # not NFC
+    ],
+)
+@pytest.mark.parametrize("consider_tld", [False, True])
+def test_returns_failed_validation_on_idna_mapped_lookalike(value: str, consider_tld: bool):
+    """Test returns failed validation on names that only IDNA 2003 mapping makes valid."""
+    assert isinstance(domain(value, consider_tld=consider_tld), ValidationError)
+
+
+@pytest.mark.parametrize(
+    "value",
+    ["пример.рф", "ПРИМЕР.РФ", "例子.中国", "kräuter.com", "straße.de", "ς.gr", "εχαμπλε.gr"],
+)
+def test_returns_true_on_idn_without_lookalike_mapping(value: str):
+    """Test returns true on internationalized names that need no lossy mapping."""
+    assert domain(value)
diff --git a/tests/test_email.py b/tests/test_email.py
index 990ef8ee..f3066c88 100644
--- a/tests/test_email.py
+++ b/tests/test_email.py
@@ -66,3 +66,9 @@ def test_rejects_newline_after_local_part(local_part: str):
     # 2026-10-11: A newline before the at-sign is not part of a valid local part.
     assert email(f"{local_part}@example.com") is True
     assert isinstance(email(f"{local_part}\n@example.com"), ValidationError)
+
+
+@pytest.mark.parametrize("domain_part", ["example.ｃｏｍ", "exam­ple.com"])
+def test_returns_failed_validation_on_idna_mapped_lookalike_domain(domain_part: str):
+    """Test returns failed validation on email domains that only IDNA 2003 mapping makes valid."""
+    assert isinstance(email(f"user@{domain_part}"), ValidationError)
diff --git a/tests/test_hostname.py b/tests/test_hostname.py
index df54b02d..97671267 100644
--- a/tests/test_hostname.py
+++ b/tests/test_hostname.py
@@ -125,3 +125,15 @@ def test_returns_failed_validation_on_hostname_beyond_rfc_limits(value: str):
 def test_rejects_trailing_newline_in_hostnames_and_ports(value: str):
     """Test rejects trailing newline in hostnames and ports."""
     assert isinstance(hostname(value), ValidationError)
+
+
+@pytest.mark.parametrize("value", ["ſerver", "Kelvin", "ıntranet", "İntranet:8080"])
+def test_returns_failed_validation_on_non_ascii_simple_hostname(value: str):
+    """Test returns failed validation on non-ASCII case equivalents in simple hostnames."""
+    assert isinstance(hostname(value), ValidationError)
+
+
+@pytest.mark.parametrize("value", ["example.ｃｏｍ", "exam­ple.com:443"])
+def test_returns_failed_validation_on_idna_mapped_lookalike_hostname(value: str):
+    """Test returns failed validation on hostnames that only IDNA 2003 mapping makes valid."""
+    assert isinstance(hostname(value), ValidationError)
diff --git a/tests/test_url.py b/tests/test_url.py
index 8d5023b6..2cfded8b 100644
--- a/tests/test_url.py
+++ b/tests/test_url.py
@@ -257,3 +257,12 @@ def test_url_rejects_raw_ascii_controls(control: str, template: str):
 def test_url_accepts_percent_encoded_controls(encoded: str, template: str):
     """Keep escaped data valid while rejecting literal control characters."""
     assert url(template.format(encoded=encoded)) is True
+
+
+@pytest.mark.parametrize(
+    "value",
+    ["https://example.ｃｏｍ/", "https://exam­ple.com/", "http://ſerver/"],
+)
+def test_returns_failed_validation_on_idna_mapped_lookalike_url(value: str):
+    """Test returns failed validation on url hosts that only IDNA 2003 mapping makes valid."""
+    assert isinstance(url(value, simple_host=True), ValidationError)