### Impact
`Addressable::IDNA.to_unicode`, in the pure-Ruby IDNA implementation, decodes Punycode labels (labels beginning with `xn--`) that are not valid A-labels. Those labels are returned in decoded form, when they should be returned unchanged. That includes:
- labels that decode to only ASCII characters, e.g. `xn--google-` decodes to `google`;
- labels that decode to text that doesn't convert back to the same label (RFC 3490 §4.2), e.g. text that isn't in normalized form.
`Addressable::URI#display_uri` uses `to_unicode`, so for `https://xn--google-.example.org/` it displays the host `google.example.org`, while `#host`, `#normalized_host` and any connection made from the URI use `xn--google-.example.org`. An attacker who controls a domain can therefore have a URI displayed as a host they don't control. Applications that compare the result of `to_unicode` against a list of trusted names can likewise treat two different hosts as the same.
The native IDNA implementation, used when libidn and the `idn-ruby` gem are installed, is not affected. `to_ascii` and `normalized_host` are not affected.
### Affected Versions
This vulnerability affects Addressable >= 2.0.0, the first version with the pure-Ruby IDNA implementation, when that implementation is in use. It is fixed in 2.9.1, where such labels are returned unchanged, as with libidn.
### Workarounds
- Install libidn and the `idn-ruby` gem, so that Addressable uses the native IDNA implementation.
- Don't make security decisions on `display_uri` or `to_unicode` output. Compare hosts using `normalized_host`.
### Credits
Reported by @tonghuaroot.
### For more information
If there are any questions or comments about this advisory:
* [Open an issue](https://github.com/sporkmonger/addressable/issues)