Skip to content

gh-73936: Add hashlib.saslprep (RFC 4013) and use it in smtplib for Unicode credentials#148692

Open
blink1073 wants to merge 3 commits intopython:mainfrom
blink1073:unicode-passwords-smtplib
Open

gh-73936: Add hashlib.saslprep (RFC 4013) and use it in smtplib for Unicode credentials#148692
blink1073 wants to merge 3 commits intopython:mainfrom
blink1073:unicode-passwords-smtplib

Conversation

@blink1073
Copy link
Copy Markdown

@blink1073 blink1073 commented Apr 17, 2026

This is a continuation of #103611, updated to address all open reviewer comments.

Changes

  • Lib/_saslprep.py (new): RFC 4013 SASLprep implementation, adapted from
    the PyMongo project with
    permission. Apache 2.0 licence header retained; MongoDB corporate CLA is
    signed.
  • Lib/hashlib.py: exposes saslprep as hashlib.saslprep (public API),
    per the suggestion from @gpshead in the original review.
  • Lib/smtplib.py: applies hashlib.saslprep() in auth_plain(),
    auth_login(), and auth_cram_md5(); switches auth() encoding from
    'ascii' to 'utf-8'.
  • Lib/test/test_saslprep.py (new): tests for RFC 4013 examples,
    character mapping, prohibited characters, bidirectional checks, unassigned
    code points, and test cases from the MongoDB JS saslprep library.
  • Lib/test/test_smtplib.py: adds Unicode credentials to the simulated
    server (Devanagari username/password; a password that SASLprep normalises via
    NFKC) and exercises all three auth mechanisms with them, including verifying
    that SASLprep-equivalent passwords authenticate successfully.
  • Python/stdlib_module_names.h: registers _saslprep.
  • Doc/library/hashlib.rst: new "String preparation" section documenting
    hashlib.saslprep().

📚 Documentation preview 📚: https://cpython-previews--148692.org.readthedocs.build/

blink1073 and others added 2 commits April 17, 2026 11:02
…e credentials

Co-authored-by: Arnt Gulbrandsen <arnt@gulbrandsen.priv.no>
Co-authored-by: Bernie Hackett <bernie.hackett@gmail.com>
@blink1073 blink1073 requested review from a team, gpshead and picnixz as code owners April 17, 2026 16:05
@python-cla-bot
Copy link
Copy Markdown

python-cla-bot bot commented Apr 17, 2026

All commit authors signed the Contributor License Agreement.

CLA signed

@blink1073
Copy link
Copy Markdown
Author

Kicking to re-run the CLA bot

@blink1073 blink1073 closed this Apr 17, 2026
@blink1073 blink1073 reopened this Apr 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant