x/net/idna: no documentation for what `StrictDomainName=false` ruleset accepts

[whitequark]

Go version

go version go1.25.1 linux/amd64

Output of go env in your module/workspace:

AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE=''
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN='/home/whitequark/.local/bin'
GOCACHE='/home/whitequark/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/home/whitequark/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1588135198=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/home/whitequark/Projects/git-pages/go.mod'
GOMODCACHE='/home/whitequark/.local/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/home/whitequark/.local/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/home/whitequark/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.25.1'
GOWORK=''
PKG_CONFIG='pkg-config'

What did you do?

I would like to use the x/net/idna package to validate DNS names in git-pages, where it is important that URL hostnames are treated similarly to how a browser does it. In practice, it seems that people want to have DNS names like user_name.some.tld to work, even though these are not valid STD 3 hostnames. I want to allow the U+005F LOW LINE character, but it is not clear which other characters this will allow.

What did you see happen?

The documentation does not state what character set is accepted by StrictDomainName=false over the character set accepted with StrictDomainName=true.

What did you expect to see?

I expected the documentation to list an exhaustive set of characters rather than a "for example, [character] is accepted".

[whitequark]

I have also read TR46 (which leaves this to the implementation) and looked at the source code (which is extremely complex and I was not able to extract the answer I needed).

[whitequark]

From experimentation, it seems like * is allowed with StrictDomainName=false, which is not what I expected. Considering the documentation says:

This option is useful, for instance, for browsers that allow characters outside this range, for example a '_' (U+005F LOW LINE). See http://www.rfc-editor.org/std/std3.txt for more details.

and browsers (the only listed case) don't really allow you to use * as a DNS label (as far as I know anyway), I doubt anybody would have expected this.

In git-pages, I am submitting TLS certificate requests based on the domain names validated by the IDNA package. Allowing * would definitely be a problem.

My desired resolution of this issue would be both of:

1. Document the character set accepted with StrictDomainName=false;
2. Add an option that just allows the things that specifically browsers accept (perhaps just the U+005F LOW LINE character, but I am not an Unicode expert).

[gabyhelp]

Related Issues

• x/net/idna: StrictDomainName doesn't work with Profile.ToASCII #74848
• net/http, x/net/idna: punycode labels ending with hyphen (xn--example-) should be rejected per updated UTS-46 #74330
• x/net/idna: separate CheckHyphens from ValidateLabel #41732 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[dr2chase]

@neild @ianlancetaylor

[neild]

With the disclaimer that I am not familiar with this code:

The character sets accepted are taken from the IDNA 13.0.0 mapping table: https://www.unicode.org/Public/idna/13.0.0/IdnaMappingTable.txt

For an entry in the table with a status of "disallowed_STD3_valid", the entry is disallowed when StrictDomainName(true) and valid when StrictDomainName(false).

[whitequark]

Thank you. Having a link to this in the documentation would be very useful (I had no idea U+007F is allowed, or ≠ for some reason...)