x/net/idna: VerifyDNSLength is not rejecting empty labels

[zeroizerz]

What did you do?

https://go.dev/play/p/YZC2LJAeSLm

What did you expect to see?

Result consistent with https://unicode.org/reports/tr46/#ToASCII

If the VerifyDnsLength flag is true, then verify DNS length restrictions.

The length of each label is from 1 to 63.

profile.ToASCII(www..com.) = www..com. idna: invalid label "www..com."
profile.ToASCII(www..ćóḿ.) = www..xn--kda3b580m. idna: invalid label "www..ćóḿ."
profile.ToASCII(www.example..) = www.example.. idna: invalid label ""
profile.ToASCII(www.éxamplé..) = www.xn--xampl-9raf.. idna: invalid label ""

What did you see instead?

profile.ToASCII(www..com.) = www..com. idna: invalid label "www..com."
profile.ToASCII(www..ćóḿ.) = www..xn--kda3b580m. idna: invalid label "www..ćóḿ."
profile.ToASCII(www.éxamplé..) = www.xn--xampl-9raf.. idna: invalid label ""

[dmitshur]

CC @neild, @ianlancetaylor.

[elliotwutingfeng]

This is likely a duplicate of #47182

[zeroizerz]

@elliotwutingfeng Thank you for identifying the source of the problem. This fixes the empty TLD with root label case (www.example.com..) in #47182, but actually the root label is also disallowed (www.example.com.):

When VerifyDnsLength is true, the empty root label is disallowed.

So I made a mistake in my original post, the output should be:

profile.ToASCII(www.example.com.) = www.example.com. idna: invalid label "www.example.com."
profile.ToASCII(www.éxamplé.ćóḿ.) = www.xn--xampl-9raf.xn--kda3b580m. idna: invalid label "www.éxamplé.ćóḿ."
profile.ToASCII(www..com.) = www..com. idna: invalid label "www..com."
profile.ToASCII(www..ćóḿ.) = www..xn--kda3b580m. idna: invalid label "www..ćóḿ."
profile.ToASCII(www.example..) = www.example.. idna: invalid label ""
profile.ToASCII(www.éxamplé..) = www.xn--xampl-9raf.. idna: invalid label ""

So both this issue and #47182 should be resolved by just disallowing the root label when VerifyDNSLength is true. Here is a corrected playground test: https://go.dev/play/p/FvuwfgkvzqP

[elliotwutingfeng]

Thanks for the update, I've made a PR to fix this at golang/text#43