# sethmlarson.dev

> Some internet standards only support ASCII characters, but the world uses much more than the Latin alphabet.

- **Website:** https://sethmlarson.dev/when-str-lower-is-a-security-vulnerability
- **Pricing:** open source
- **Categories:** Developer Tools, Data & Analytics
- **Tags:** developer-tools, data-analytics, design
- **Platforms:** Web
- **Last verified:** 2026-08-26
- **Canonical page:** https://linkrena.com/tools/sethmlarson-dev

## About

When str.lower() is a security vulnerability in Python — Seth Larson

much more than the Latin alphabet. Thus, a mapping from Unicode to

(IDNA), also known as “IDNA 2003”. The StringPrep algorithm is defined in

Python supports IDNA 2003 through the idna codec ( str.encode('idna') ) and

IDNA 2008 is supported by the idna package on the Python package Index .

in the standard library. In general, you should be using the idna package (IDNA 2008)

StringPrep defines the “case folding” step (case folding is approximately “how to lowercase/uppercase a codepoint”) in Section 3.2 , enabling case-insensitive

comparisons of strings, by mapping all characters through mapping tables B.2 and B.3 .

B.2 is effectively str.lower() , lowercasing all characters according to

Unicode rules and B.3 contains the exceptions. The Python code implementing

this (and assuming B.3 table is captured correctly) is the following code below:

And that might seem fine... and the title probably gave it away already.

Why? Because str uses whatever Unicode data that the particular Python

There's also a database of Unicode 3.2.0 data available on every version

of Python ( unicodedata.ucd_3_2_0 ) specifically for the StringPrep and IDNA algorithms:

This is important! StringPrep depends on this specific version of Unicode

to operate consistently, the B.2 and B.3 tables in RFC 3454 are essentially

## Related tools

- [Hexstrike AI](https://linkrena.com/tools/hexstrike-ai): HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pent…
- [CAIPE](https://linkrena.com/tools/caipe): Open-source multi-agent system for AI-powered platform engineering.
- [Texbrain](https://linkrena.com/tools/texbrain): FOSS browser-based LaTeX editor with live preview, on-demand packages and git integration.
- [Tako VM](https://linkrena.com/tools/tako-vm): Tako VM is a secure file system and Python execution layer for AI agents: gVisor-isolated Docker containers with job queues, workers, retries, and replay.
- [Global Solo](https://linkrena.com/tools/global-solo): Which US business banking providers accept non-US-resident founders of US LLCs: 19 providers × 8 countries of residence, 239 verified claims, every cell cited…
- [Keenable.ai](https://linkrena.com/tools/keenable-ai): Crawler, index and ranking rebuilt for AI scale: 100B+ documents, <250ms p95 (US East), from $1 / 1K requests @ 100 RPS+.