Merge branch 'master' into njshah301/mosapi-monitoring-client-api

njshah301 · web-flow · commit 2fbc3861c9ec · 2025-12-23T11:41:44.000+05:30
diff --git a/core/src/main/java/google/registry/tools/CreateOrUpdateRegistrarCommand.java b/core/src/main/java/google/registry/tools/CreateOrUpdateRegistrarCommand.java
@@ -19,12 +19,12 @@
 import static com.google.common.base.Verify.verify;
 import static com.google.common.collect.ImmutableList.toImmutableList;
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
-import static google.registry.util.DomainNameUtils.canonicalizeHostname;
 import static google.registry.util.RegistrarUtils.normalizeRegistrarName;
 import static java.nio.charset.StandardCharsets.US_ASCII;
 import static org.joda.time.DateTimeZone.UTC;
 
 import com.beust.jcommander.Parameter;
+import com.google.common.base.Ascii;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
 import google.registry.flows.certs.CertificateChecker;
@@ -305,20 +305,16 @@ protected final void init() throws Exception {
       if (!allowedTlds.isEmpty()) {
         checkArgument(
             addAllowedTlds.isEmpty(), "Can't specify both --allowedTlds and --addAllowedTlds");
-        ImmutableSet.Builder<String> allowedTldsBuilder = new ImmutableSet.Builder<>();
-        for (String allowedTld : allowedTlds) {
-          allowedTldsBuilder.add(canonicalizeHostname(allowedTld));
-        }
-        builder.setAllowedTlds(allowedTldsBuilder.build());
+        builder.setAllowedTlds(
+            allowedTlds.stream().map(Ascii::toLowerCase).collect(toImmutableSet()));
       }
       if (!addAllowedTlds.isEmpty()) {
         ImmutableSet.Builder<String> allowedTldsBuilder = new ImmutableSet.Builder<>();
         if (oldRegistrar != null) {
           allowedTldsBuilder.addAll(oldRegistrar.getAllowedTlds());
         }
-        for (String allowedTld : addAllowedTlds) {
-          allowedTldsBuilder.add(canonicalizeHostname(allowedTld));
-        }
+        allowedTldsBuilder.addAll(
+            addAllowedTlds.stream().map(Ascii::toLowerCase).collect(toImmutableSet()));
         builder.setAllowedTlds(allowedTldsBuilder.build());
       }
       if (ipAllowList != null) {
diff --git a/core/src/test/java/google/registry/tools/UpdateRegistrarCommandTest.java b/core/src/test/java/google/registry/tools/UpdateRegistrarCommandTest.java
@@ -124,6 +124,24 @@ void testSuccess_allowedTlds() throws Exception {
         .containsExactly("xn--q9jyb4c", "foobar");
   }
 
+  @Test
+  void testSuccess_allowedTlds_tldNameWithHyphens() throws Exception {
+    persistRdapAbuseContact();
+    createTlds("zz--main-1611", "foobar");
+    persistResource(
+        loadRegistrar("NewRegistrar")
+            .asBuilder()
+            .setAllowedTlds(ImmutableSet.of("foobar"))
+            .build());
+    runCommandInEnvironment(
+        RegistryToolEnvironment.PRODUCTION,
+        "--allowed_tlds=zz--main-1611,foobar",
+        "--force",
+        "NewRegistrar");
+    assertThat(loadRegistrar("NewRegistrar").getAllowedTlds())
+        .containsExactly("zz--main-1611", "foobar");
+  }
+
   @Test
   void testSuccess_addAllowedTlds() throws Exception {
     persistRdapAbuseContact();
@@ -142,6 +160,19 @@ void testSuccess_addAllowedTlds() throws Exception {
         .containsExactly("xn--q9jyb4c", "foo", "bar");
   }
 
+  @Test
+  void testSuccess_addAllowedTlds_tldNameWithHyphens() throws Exception {
+    persistRdapAbuseContact();
+    createTlds("foo", "bar", "zz--main-1611");
+    runCommandInEnvironment(
+        RegistryToolEnvironment.PRODUCTION,
+        "--add_allowed_tlds=foo,bar",
+        "--force",
+        "NewRegistrar");
+    assertThat(loadRegistrar("NewRegistrar").getAllowedTlds())
+        .containsExactly("foo", "bar", "zz--main-1611");
+  }
+
   @Test
   void testSuccess_addAllowedTldsWithDupes() throws Exception {
     persistRdapAbuseContact();
diff --git a/util/src/main/java/google/registry/util/DomainNameUtils.java b/util/src/main/java/google/registry/util/DomainNameUtils.java
@@ -19,9 +19,11 @@
 
 import com.google.common.base.Ascii;
 import com.google.common.base.Joiner;
+import com.google.common.base.Splitter;
 import com.google.common.base.Strings;
 import com.google.common.collect.ImmutableList;
 import com.google.common.net.InternetDomainName;
+import java.util.List;
 
 /** Utility methods related to domain names. */
 public final class DomainNameUtils {
@@ -39,14 +41,34 @@ public static boolean isUnder(InternetDomainName name, InternetDomainName potent
             .equals(potentialParent.parts());
   }
 
-  /** Canonicalizes a hostname/domain name by lowercasing and converting unicode to punycode. */
+  /**
+   * Canonicalizes a hostname/domain name by lowercasing and converting Unicode to punycode.
+   *
+   * <p>This applies slightly stricter rules to all labels other than the TLD part (all other labels
+   * are not allowed to have hyphens in the third and fourth position except when using
+   * ACE-formatted Punycode). This restriction is not enforced on the last label (so multi-part TLDs
+   * still cannot have said characters except on the last part).
+   */
   public static String canonicalizeHostname(String label) {
     String labelLowercased = Ascii.toLowerCase(label);
-    try {
-      return Idn.toASCII(labelLowercased);
-    } catch (IllegalArgumentException e) {
-      throw new IllegalArgumentException(String.format("Error ASCIIfying label '%s'", label), e);
+    String finalChar = "";
+    if (labelLowercased.endsWith(".")) {
+      labelLowercased = labelLowercased.substring(0, labelLowercased.length() - 1);
+      finalChar = ".";
+    }
+    List<String> parts = Splitter.on('.').splitToList(labelLowercased);
+    // If the hostname only has one part, just canonicalize that.
+    if (parts.size() == 1) {
+      return Idn.toASCII(parts.getFirst()) + finalChar;
+    }
+    // If the hostname has multiple parts, apply stricter validation to all labels but the last
+    // one (which relaxes the hyphens in third and fourth positions rule).
+    StringBuilder sb = new StringBuilder();
+    for (int i = 0; i < parts.size() - 1; i++) {
+      sb.append(Idn.toASCII(parts.get(i))).append('.');
     }
+    sb.append(Idn.tldToASCII(parts.getLast())).append(finalChar);
+    return sb.toString();
   }
 
   /**
diff --git a/util/src/main/java/google/registry/util/Idn.java b/util/src/main/java/google/registry/util/Idn.java
@@ -14,9 +14,15 @@
 
 package google.registry.util;
 
+import static com.google.common.base.Preconditions.checkArgument;
+
 import com.google.common.base.Joiner;
+import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.Sets;
 import com.ibm.icu.text.IDNA;
+import com.ibm.icu.text.IDNA.Error;
 import com.ibm.icu.text.IDNA.Info;
+import java.util.Set;
 
 /**
  * A partial API-compatible replacement for {@link java.net.IDN} that replaces <a
@@ -51,11 +57,29 @@ public static String toASCII(String name) {
     StringBuilder result = new StringBuilder();
     UTS46_INSTANCE.nameToASCII(name, result, info);
     if (info.hasErrors()) {
-      throw new IllegalArgumentException("Errors: " + Joiner.on(',').join(info.getErrors()));
+      throw new IllegalArgumentException(
+          String.format(
+              "Errors ASCIIfying label %s: %s", name, Joiner.on(',').join(info.getErrors())));
     }
     return result.toString();
   }
 
+  /**
+   * Translates a TLD string from Unicode to Punycoded ASCII.
+   *
+   * <p>Unlike {@link #toASCII}, this method does NOT enforce the restriction that hyphens may only
+   * be present on the third and fourth characters for "xn--" ACE-formatted domains.
+   */
+  public static String tldToASCII(String name) {
+    Info info = new Info();
+    StringBuilder result = new StringBuilder();
+    UTS46_INSTANCE.nameToASCII(name, result, info);
+    Set<Error> errors = Sets.difference(info.getErrors(), ImmutableSet.of(Error.HYPHEN_3_4));
+    checkArgument(
+        errors.isEmpty(), "Errors ASCIIfying label %s: %s", name, Joiner.on(',').join(errors));
+    return result.toString();
+  }
+
   /**
    * Translates a string from ASCII Compatible Encoding (ACE) to Unicode, as defined by the
    * ToUnicode operation of <a href="http://www.ietf.org/rfc/rfc3490.txt">RFC 3490</a>.
diff --git a/util/src/test/java/google/registry/util/DomainNameUtilsTest.java b/util/src/test/java/google/registry/util/DomainNameUtilsTest.java
@@ -45,13 +45,37 @@ void testCanonicalizeHostname_allowsRdnsNames() {
         .isEqualTo("119.63.227.45-ns1.jhz-tt.uk");
   }
 
+  @Test
+  void testCanonicalizeHostname_retainsTrailingDot() {
+    assertThat(canonicalizeHostname("みんな.みんな.")).isEqualTo("xn--q9jyb4c.xn--q9jyb4c.");
+    assertThat(canonicalizeHostname("BAR.foo.みんな.")).isEqualTo("bar.foo.xn--q9jyb4c.");
+    assertThat(canonicalizeHostname("cat.lol.")).isEqualTo("cat.lol.");
+  }
+
   @Test
   void testCanonicalizeHostname_throwsOn34HyphenRule() {
     IllegalArgumentException thrown =
         assertThrows(
             IllegalArgumentException.class,
             () -> canonicalizeHostname("119.63.227.45--ns1.jhz-tt.uk"));
-    assertThat(thrown).hasCauseThat().hasMessageThat().contains("HYPHEN_3_4");
+    assertThat(thrown).hasMessageThat().contains("HYPHEN_3_4");
+  }
+
+  @Test
+  void testCanonicalizeHostname_throwsOn34HyphenRule_withTrailingDot() {
+    IllegalArgumentException thrown =
+        assertThrows(
+            IllegalArgumentException.class,
+            () -> canonicalizeHostname("119.63.227.45--ns1.jhz-tt.uk."));
+    assertThat(thrown).hasMessageThat().contains("HYPHEN_3_4");
+  }
+
+  @Test
+  void testCanonicalizeHostname_allows34HyphenOnTld() {
+    assertThat(canonicalizeHostname("foobar.zz--main-2262")).isEqualTo("foobar.zz--main-2262");
+    assertThat(canonicalizeHostname("foobar.zz--main-2262.")).isEqualTo("foobar.zz--main-2262.");
+    assertThat(canonicalizeHostname("みんな.45--foo")).isEqualTo("xn--q9jyb4c.45--foo");
+    assertThat(canonicalizeHostname("みんな.45--foo.")).isEqualTo("xn--q9jyb4c.45--foo.");
   }
 
   @Test
