Unicode collision: stringprep, saslprep

[westurner]

The stringprep routines in passlib.utils.saslprep may be relevant to some of the usecases for unicode-slugify.

References

• http://www.reddit.com/r/programming/comments/1gl0zn/a_security_hole_via_unicode_usernames/cali4b9
• http://www.reddit.com/r/Python/comments/1higug/the_updated_guide_to_unicode_on_python_armin/cav3rxd

[nitely]

Everything described by rfc4013 (Stringprep) seems to be covered by slugify. It does NFKC (normalization form into compatibility decomposition + canonical composition), then keeps characters defined as letter or number by the unicode character database (so, no invisible characters).

That said, why anyone would use unicode for usernames is beyond me. There are plenty of chars that look alike.