Change description:

We have a security vulnerability that is rather long in the tooth (https://bugs.chromium.org/p/chromium/issues/detail?id=695474&desc=2, not yet public) that depends, in part, on our DNS resolver’s willingness to attempt to resolve arbitrary garbage strings, including strings that could not ever be valid hostnames.

I propose to remove support for such requests in our DNS resolution code, and attempt only to resolve legal hostnames (“preferred name syntax”). Additionally, I propose we accept underscores (_) in names. (See the measurement CL.)

Note that IDNs are Punycode on the wire, and hence are expressed in preferred name syntax.

Changes to API surface:

Don't issue DNS queries for names that contain characters other than what |IsValidHostLabelCharacter| would allow. That function is defined in https://codereview.chromium.org/2739203003.

Links:

Discussion to come on blink-dev.

Support in other browsers:

I don't know yet. Will test.