bug#24117: 25.1; url-http-create-request: Multibyte text in HTTP request

[Ted Zlatanov]

On Thu, 11 Aug 2016 15:00:55 +0200 Lars Ingebrigtsen <larsi@gnus.org> wrote: 

LI> Ted Zlatanov <tzz@lifelogs.com> writes:
>> Somewhat related: it would be nice if the URL parser also listed the
>> non-ASCII scripts used in the domain name. Then eww and other programs
>> could do one of the typical defenses: either ensure only one script is
>> used; or allow only scripts that match the user's locale; or catch any
>> non-ASCII domain names. Typically they'd use Punycode to display such
>> suspicious domain names:
>> https://en.wikipedia.org/wiki/IDN_homograph_attack

LI> This is implemented in puny and eww:

LI>   ;; Check whether the domain only uses "Highly Restricted" Unicode
LI>   ;; IDNA characters.  If not, transform to punycode to indicate that
LI>   ;; there may be funny business going on.
LI>   (let ((parsed (url-generic-parse-url url)))
LI>     (unless (puny-highly-restrictive-domain-p (url-host parsed))
LI>       (setf (url-host parsed) (puny-encode-domain (url-host parsed)))
LI>       (setq url (url-recreate-url parsed))))

Awesome! Thanks for pointing this out, and sorry for digressing.

Ted