gh-98433: Fix quadratic time idna decoding.

Lib/encodings/idna.py

@@ -39,6 +39,7 @@ def nameprep(label):
 
     # Check bidi
     RandAL = [stringprep.in_table_d1(x) for x in label]
+    any_in_table_d2 = any(stringprep.in_table_d2(x) for x in label)
     for c in RandAL:
         if c:
             # There is a RandAL char in the string. Must perform further
@@ -47,7 +48,7 @@ def nameprep(label):
             # This is table C.8, which was already checked
             # 2) If a string contains any RandALCat character, the string
             # MUST NOT contain any LCat character.
-            if any(stringprep.in_table_d2(x) for x in label):
+            if any_in_table_d2:
                 raise UnicodeError("Violation of BIDI requirement 2")
 
             # 3) If a string contains any RandALCat character, a
@@ -112,6 +113,11 @@ def ToUnicode(label):
             pure_ascii = True
         except UnicodeError:
             pure_ascii = False
+    if len(label) > 300:
+        # Per DNS, > 63. This leaves room for nameprep() to remove various
+        # characters while still preventing us from wasting CPU on decoding a
+        # big thing that'll just hit the actual <= 63 length limit in Step 6.
+        raise UnicodeError("label way too long")
     if not pure_ascii:
         # Step 2: Perform nameprep
         label = nameprep(label)

Lib/test/test_codecs.py

@@ -1552,6 +1552,11 @@ def test_builtin_encode(self):
         self.assertEqual("pyth\xf6n.org".encode("idna"), b"xn--pythn-mua.org")
         self.assertEqual("pyth\xf6n.org.".encode("idna"), b"xn--pythn-mua.org.")
 
+    def test_builtin_decode_length_limit(self):
+        with self.assertRaises(UnicodeError) as ctx:
+            (b"xn--016c"+b"a"*500).decode("idna")
+        self.assertIn("label way too long", str(ctx.exception))
+
     def test_stream(self):
         r = codecs.getreader("idna")(io.BytesIO(b"abc"))
         r.read(3)

Misc/NEWS.d/next/Security/2022-11-04-09-29-36.gh-issue-98433.l76c5G.rst

@@ -0,0 +1,3 @@
+The IDNA codec decoder used on DNS hostnames no longer involves a quadratic
+algorithm. This prevents a potential CPU denial of service if an out-of-spec
+excessive length hostname involving bidirectional characters is decoded.