chore: Update idna to 1.0, drop unicode-normalization

[torokati44]

Now that all of url, cookie_store, and publicsuffix are out with releases depending on idna 1.0.x, we can switch to that.

With this, the idna_adapter crate is introduced, which lets us globally control (in a hacky, but workable way), which IDNA backend we want, and allows dropping support for it entirely.

See: https://crates.io/crates/idna_adapter

It should probably be locked to 1.0.x with some mechanism. (Adding it directly to Cargo.toml, and/or configuring cargo-deny, since we already have it...)

Cc: @adrian17, since I remember you complaining a lot about the binary size bloat caused by these encoding tables... 😅

[evilpie]

We should definitely add something to (probably) deny, because this mechanism seems very brittle. I guess we could deny unicode-normalization as well now?

[torokati44]

The size of the vanilla WASM module after wasm-bindgen and wasm-opt:

idna_adapter	Bytes	Diff	Relative
(base)	12,915,705	0	100.0%
1.0	12,707,466	-208,239	98.4%
1.1	12,964,026	+48,321	100.4%
1.2	12,821,717	-93,988	99.3%

[torokati44]

Let's not forget to do a @dependabot unignore url after this is dealt with.

[torokati44]

On top of adding bans in deny.toml, it would be great if somehow it could be added as a permanent exception to cargo update, so it won't try to update (and certainly not by duplicating it!) idna_adapter... Any ideas? :/

[torokati44]

See this for testing:

package {
    import flash.display.Loader;
    import flash.display.Sprite;
    import flash.net.URLRequest;

    public class Test extends Sprite {
        var nextY = 0;

        function loadFromDomain(domain: String) {
            var imageURL:String = domain + "/img/navi/top.gif";
            var loader:Loader = new Loader();
            var req:URLRequest = new URLRequest(imageURL);
            trace("Loading from " + req.url);

            loader.load(req);
            loader.y = this.nextY;
            this.nextY += 50;
            addChild(loader);
        }

        public function Test() {
            loadFromDomain("https://www.schoen.de");
            loadFromDomain("https://www.schön.de");
            loadFromDomain("https://www.xn--schn-7qa.de");
        }
    }
}

SWF here: test.zip

On Linux, I see all 3 instances of the same image, on Windows, the middle one is missing (with the FP debugger showing an IO exception about it).

[torokati44]

This will also be needed to resolve this advisory:
https://rustsec.org/advisories/RUSTSEC-2024-0421

[adrian17]

98.4%

To be fair, -200kB was a way bigger deal when our wasm bundle was like 2MB :(

[adrian17]

Anyway, as long as evilpie's concern is resolved, I think this is safe-ish?
Worst case, if something breaks, we can just trivially revert this.

[torokati44]

Worst case, if something breaks, we can just trivially revert this.

I don't think that would be necessary even, we can easily switch between the backends now via the idna_adapter version series.

[torokati44]

Thanks to both of you! 😊

[torokati44]

@dependabot unignore url