EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Lobsters·Aug 18·5 min read
When str.lower() is a security vulnerability in Python
TL;DR
Python's str.lower() can introduce security vulnerabilities when handling Internationalized Domain Names (IDN) due to improper case folding. This issue arises from the complexities of mapping Unicode to ASCII, which is essential for domain name validation.
✦ Why It Matters
Review your use of str.lower() in Python to ensure it doesn't compromise domain name security.
Key Takeaways
- Use the idna package for IDNA 2008 compliance.
- Check your Python interpreter's Unicode version regularly.
- Implement new exceptions for str.lower() to ensure compliance.
- Stay informed about security updates in the Python ecosystem.
How It Works
StringPrep defines case folding rules for string comparisons, which are crucial for IDNA. The method str.lower() should use Unicode 3.2.0 rules, but it currently uses the version of Unicode that comes with the Python interpreter, leading to potential security issues.