Bug report

Bug description:

The punycode decoder splits its input at the last - even when that - is the first character, so a delimiter with no basic code points before it is silently dropped. RFC 3492 section 6.2 only consumes the delimiter if at least one basic code point precedes it; otherwise - is an invalid digit. The encoder already follows that rule (it never emits a leading -), so decoding accepts a second, non-canonical spelling of every all-non-ASCII label.

>>> b"80a1acny".decode("punycode")
'почта'
>>> b"-80a1acny".decode("punycode")
'почта'
>>> b"-".decode("punycode")
''

b"-80a1acny" and b"-" should raise UnicodeDecodeError; the stdlib idna codec already rejects xn---80a1acny because it re-encodes and compares, but third-party IDNA 2008 code that calls the punycode codec directly (e.g. the PyPI idna package) does not.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-161090: Reject a leading delimiter in the punycode decoder #161091