Reject IDNA-mapped lookalikes in domains and simple hostnames

Python's idna codec implements IDNA 2003, whose nameprep step drops
invisible characters (soft hyphen, zero width space, joiners, variation
selectors), folds compatibility characters such as fullwidth letters,
the Kelvin sign or the long s to ASCII, and splits labels on U+3002 and
similar dots. domain() validated the mapped result, so "example.ｃｏｍ"
or "exam­ple.com" passed as example.com through domain(),
hostname(), url() and email().

Reject non-ASCII values that are not NFKC-stable or that contain
characters nameprep maps to nothing or treats as a dot. Internationalized
names that need no such mapping, such as "пример.рф" or "straße.de",
are still accepted.

The simple hostname regex used [a-z] with re.IGNORECASE, which also
matches U+0130, U+0131, U+017F and U+212A; add re.ASCII.

Author: nandgator

src/validators/domain.py

@@ -4,7 +4,9 @@
 from os import environ
 from pathlib import Path
 import re
+from stringprep import in_table_b1
 from typing import Optional, Set
+from unicodedata import normalize
 
 # local
 from .utils import validator
@@ -37,6 +39,21 @@ def check(cls, tld: str):
         return tld in cls._full_cache
 
 
+def _relies_on_idna_mapping(value: str):
+    """Return whether `value` only becomes a valid name through IDNA 2003 mapping.
+
+    Python's `idna` codec implements IDNA 2003 (RFC 3490), whose nameprep step
+    (RFC 3491) drops invisible characters (RFC 3454, table B.1), folds
+    compatibility characters such as fullwidth letters to ASCII, and treats
+    U+3002 and similar dots as label separators. A value that needs any of
+    these only looks like the name it encodes to, e.g. "example.ｃｏｍ".
+    """
+    return not value.isascii() and (
+        normalize("NFKC", value) != value
+        or any(in_table_b1(char) or char in "\u3002\uff0e\uff61" for char in value)
+    )
+
+
 @validator
 def domain(
     value: str, /, *, consider_tld: bool = False, rfc_1034: bool = False, rfc_2782: bool = False
@@ -80,6 +97,9 @@ def domain(
         return False
 
     try:
+        if _relies_on_idna_mapping(value):
+            return False
+
         service_record = r"_" if rfc_2782 else ""
         trailing_dot = r"\.?$" if rfc_1034 else r"$"
 

src/validators/hostname.py

@@ -26,7 +26,9 @@ def _simple_hostname_regex():
     """Simple hostname validation regex."""
     # {0,59} because two characters are already matched at
     # the beginning and at the end, making the range {1, 61}
-    return re.compile(r"^(?!-)[a-z0-9](?:[a-z0-9-]{0,59}[a-z0-9])?(?<!-)$", re.IGNORECASE)
+    return re.compile(
+        r"^(?!-)[a-z0-9](?:[a-z0-9-]{0,59}[a-z0-9])?(?<!-)$", re.IGNORECASE | re.ASCII
+    )
 
 
 def _port_validator(value: str):

tests/test_domain.py

@@ -167,3 +167,39 @@ def test_returns_true_on_domain_within_rfc_length_limits(value: str):
 def test_returns_failed_validation_on_domain_beyond_rfc_limits(value: str):
     """Test returns failed validation on domain beyond RFC limits."""
     assert isinstance(domain(value), ValidationError)
+
+
+@pytest.mark.parametrize(
+    "value",
+    [
+        # IDNA 2003 maps these to "example.com"; see `_relies_on_idna_mapping`
+        "example.ｃｏｍ",  # fullwidth letters
+        "ｅｘａｍｐｌｅ.com",
+        "example.ⅽom",  # small roman numeral one hundred
+        "Kelvin.com",  # Kelvin sign
+        "ſhop.com",  # long s
+        "example。com",  # ideographic full stop
+        "example．com",  # fullwidth full stop
+        "example｡com",  # halfwidth ideographic full stop
+        "exam­ple.com",  # soft hyphen
+        "example.co​m",  # zero width space
+        "exa‍mple.com",  # zero width joiner
+        "exam️ple.com",  # variation selector
+        "examp⁠le.com",  # word joiner
+        "example.com",  # zero width no-break space
+        "exämple.com".replace("ä", "ä"),  # not NFC
+    ],
+)
+@pytest.mark.parametrize("consider_tld", [False, True])
+def test_returns_failed_validation_on_idna_mapped_lookalike(value: str, consider_tld: bool):
+    """Test returns failed validation on names that only IDNA 2003 mapping makes valid."""
+    assert isinstance(domain(value, consider_tld=consider_tld), ValidationError)
+
+
+@pytest.mark.parametrize(
+    "value",
+    ["пример.рф", "ПРИМЕР.РФ", "例子.中国", "kräuter.com", "straße.de", "ς.gr", "εχαμπλε.gr"],
+)
+def test_returns_true_on_idn_without_lookalike_mapping(value: str):
+    """Test returns true on internationalized names that need no lossy mapping."""
+    assert domain(value)

tests/test_email.py

@@ -66,3 +66,9 @@ def test_rejects_newline_after_local_part(local_part: str):
     # 2026-10-11: A newline before the at-sign is not part of a valid local part.
     assert email(f"{local_part}@example.com") is True
     assert isinstance(email(f"{local_part}\n@example.com"), ValidationError)
+
+
+@pytest.mark.parametrize("domain_part", ["example.ｃｏｍ", "exam­ple.com"])
+def test_returns_failed_validation_on_idna_mapped_lookalike_domain(domain_part: str):
+    """Test returns failed validation on email domains that only IDNA 2003 mapping makes valid."""
+    assert isinstance(email(f"user@{domain_part}"), ValidationError)

tests/test_hostname.py

@@ -125,3 +125,15 @@ def test_returns_failed_validation_on_hostname_beyond_rfc_limits(value: str):
 def test_rejects_trailing_newline_in_hostnames_and_ports(value: str):
     """Test rejects trailing newline in hostnames and ports."""
     assert isinstance(hostname(value), ValidationError)
+
+
+@pytest.mark.parametrize("value", ["ſerver", "Kelvin", "ıntranet", "İntranet:8080"])
+def test_returns_failed_validation_on_non_ascii_simple_hostname(value: str):
+    """Test returns failed validation on non-ASCII case equivalents in simple hostnames."""
+    assert isinstance(hostname(value), ValidationError)
+
+
+@pytest.mark.parametrize("value", ["example.ｃｏｍ", "exam­ple.com:443"])
+def test_returns_failed_validation_on_idna_mapped_lookalike_hostname(value: str):
+    """Test returns failed validation on hostnames that only IDNA 2003 mapping makes valid."""
+    assert isinstance(hostname(value), ValidationError)

tests/test_url.py

@@ -257,3 +257,12 @@ def test_url_rejects_raw_ascii_controls(control: str, template: str):
 def test_url_accepts_percent_encoded_controls(encoded: str, template: str):
     """Keep escaped data valid while rejecting literal control characters."""
     assert url(template.format(encoded=encoded)) is True
+
+
+@pytest.mark.parametrize(
+    "value",
+    ["https://example.ｃｏｍ/", "https://exam­ple.com/", "http://ſerver/"],
+)
+def test_returns_failed_validation_on_idna_mapped_lookalike_url(value: str):
+    """Test returns failed validation on url hosts that only IDNA 2003 mapping makes valid."""
+    assert isinstance(url(value, simple_host=True), ValidationError)