typebox 1.2.17 → 1.2.18

package/build/format/_idna.mjs

@@ -192,10 +192,29 @@ function IsPuny(value) {
 }
 function IsPunyLabel(value) {
     try {
-        return IsUnicodeLabel(Puny.Decode(value.slice(4)));
+        const payload = value.slice(4).toLowerCase();
+        // 1. Structural Validation (RFC 3492 syntax)
+        //
+        // If the payload contains a hyphen, it MUST be a delimiter separating basic
+        // ASCII characters from the variable-length integers. A payload consisting
+        // of ONLY a hyphen or starting with multiple hyphens without basic ASCII
+        // characters (like "-9uc") is fundamentally malformed.
+        //
+        const lastHyphen = payload.lastIndexOf('-');
+        if (lastHyphen === 0) {
+            // Catches "-9uc" right here because the delimiter is at index 0, meaning 0
+            // basic ASCII characters preceded it, which is non-canonical.
+            return false;
+        }
+        // 2. Decode the payload
+        const decoded = Puny.Decode(payload);
+        if (!decoded)
+            return false;
+        // 3. Validate the output rules against RFC 5892
+        return IsUnicodeLabel(decoded);
     }
     catch {
-        return false; // invalid punycode encoding
+        return false;
     }
 }
 // ------------------------------------------------------------------

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "typebox",
   "description": "Json Schema Type Builder with Static Type Resolution for TypeScript",
-  "version": "1.2.17",
+  "version": "1.2.18",
   "keywords": [
     "typescript",
     "jsonschema"