typebox - npm Package Compare versions

Comparing version 1.2.17 to 1.2.18

build/format/_idna.mjs

@@ -195,6 +195,25 @@ import * as Puny from './_puny.mjs';
     try {
-        return IsUnicodeLabel(Puny.Decode(value.slice(4)));
+        const payload = value.slice(4).toLowerCase();
+        // 1. Structural Validation (RFC 3492 syntax)
+        //
+        // If the payload contains a hyphen, it MUST be a delimiter separating basic
+        // ASCII characters from the variable-length integers. A payload consisting
+        // of ONLY a hyphen or starting with multiple hyphens without basic ASCII
+        // characters (like "-9uc") is fundamentally malformed.
+        //
+        const lastHyphen = payload.lastIndexOf('-');
+        if (lastHyphen === 0) {
+            // Catches "-9uc" right here because the delimiter is at index 0, meaning 0
+            // basic ASCII characters preceded it, which is non-canonical.
+            return false;
+        }
+        // 2. Decode the payload
+        const decoded = Puny.Decode(payload);
+        if (!decoded)
+            return false;
+        // 3. Validate the output rules against RFC 5892
+        return IsUnicodeLabel(decoded);
     }
     catch {
-        return false; // invalid punycode encoding
+        return false;
     }
@@ -201,0 +220,0 @@ }

package.json

 {
   "name": "typebox",
   "description": "Json Schema Type Builder with Static Type Resolution for TypeScript",
-  "version": "1.2.17",
+  "version": "1.2.18",
   "keywords": [
@@ -6,0 +6,0 @@ "typescript",

No alert changes

Improved metrics

Total package byte prevSize

1512566

0.06%

Lines of code

17258

0.11%

No dependency changes