From 2d5129d2b310e497a1821044acad0ec60bc9ef5c Mon Sep 17 00:00:00 2001
From: Damien Neil <dneil@google.com>
Date: Thu, 09 Jul 2026 19:00:57 -0700
Subject: [PATCH] [release-branch.go1.25] all: update x/net

Pulls in a change to x/net/idna to reject all-ASCII xn-- labels.

For #78760
Fixes #80297 
Fixes CVE-2026-39821

Change-Id: I3aae285219eadc3730927320ee58466a6a6a6964
Reviewed-on: https://go-review.googlesource.com/c/go/+/799121
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: David Chase <drchase@google.com>
---

diff --git a/vendor/golang.org/x/net/idna/idna10.0.0.go b/vendor/golang.org/x/net/idna/idna10.0.0.go
index 7b37178..0743e91 100644
--- a/vendor/golang.org/x/net/idna/idna10.0.0.go
+++ b/vendor/golang.org/x/net/idna/idna10.0.0.go
@@ -362,7 +362,8 @@
 			continue
 		}
 		if strings.HasPrefix(label, acePrefix) {
-			u, err2 := decode(label[len(acePrefix):])
+			enc := label[len(acePrefix):]
+			u, err2 := decode(enc)
 			if err2 != nil {
 				if err == nil {
 					err = err2
@@ -370,6 +371,9 @@
 				// Spec says keep the old label.
 				continue
 			}
+			if err == nil && len(u) > 0 && isASCII(u) {
+				err = punyError(enc)
+			}
 			isBidi = isBidi || bidirule.DirectionString(u) != bidi.LeftToRight
 			labels.set(u)
 			if err == nil && p.fromPuny != nil {
@@ -424,6 +428,15 @@
 	return s, err
 }
 
+func isASCII(s string) bool {
+	for _, c := range []byte(s) {
+		if c >= 0x80 {
+			return false
+		}
+	}
+	return true
+}
+
 func normalize(p *Profile, s string) (mapped string, isBidi bool, err error) {
 	// TODO: consider first doing a quick check to see if any of these checks
 	// need to be done. This will make it slower in the general case, but