From 9de078544828f7206ee8da3c5ff2c6c55ed7501a Mon Sep 17 00:00:00 2001
From: "Edward Z. Yang" <ezyang@mit.edu>
Date: Fri, 6 Jan 2012 05:32:53 -0800
Subject: [PATCH] Remark about bypassing host list with punycode.

Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
---
 library/HTMLPurifier/URIFilter/HostBlacklist.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/library/HTMLPurifier/URIFilter/HostBlacklist.php b/library/HTMLPurifier/URIFilter/HostBlacklist.php
index 045aa099..55fde3bf 100644
--- a/library/HTMLPurifier/URIFilter/HostBlacklist.php
+++ b/library/HTMLPurifier/URIFilter/HostBlacklist.php
@@ -1,5 +1,9 @@
 <?php
 
+// It's not clear to me whether or not Punycode means that hostnames
+// do not have canonical forms anymore. As far as I can tell, it's
+// not a problem (punycoding should be identity when no Unicode
+// points are involved), but I'm not 100% sure
 class HTMLPurifier_URIFilter_HostBlacklist extends HTMLPurifier_URIFilter
 {
     public $name = 'HostBlacklist';
-- 
2.11.4.GIT