@@ -291,8 +291,9 @@ cdef class SCRAMAuthentication:
291291 # Table C.1.2 -- non-ASCII spaces
292292 # Table B.1 -- "Commonly mapped to nothing"
293293 normalized_password = u " "
294- [' ' if stringprep.in_table_c12(c) else c
295- for c in normalized_password if not stringprep.in_table_b1(c)])
294+ ' ' if stringprep.in_table_c12(c) else c
295+ for c in tuple (normalized_password) if not stringprep.in_table_b1(c)
296+ )
296297
297298 # If at this point the password is empty, PostgreSQL uses the original
298299 # password
@@ -307,17 +308,20 @@ cdef class SCRAMAuthentication:
307308 if not normalized_password:
308309 return original_password
309310
311+ normalized_password_tuple = tuple (normalized_password)
312+ 310313 # Step 3 of SASLPrep: Prohobited characters. If PostgreSQL detects any
311314 # of the prohibited characters in SASLPrep, it will use the original
312315 # password
313316 # We also include "unassigned code points" in the prohibited character
314317 # category as PostgreSQL does the same
315- for c in normalized_password:
316- if any ([in_prohibited_table(c) for in_prohibited_table in
317- self .SASLPREP_PROHIBITED]):
318+ for c in normalized_password_tuple:
319+ if any (
320+ in_prohibited_table(c)
321+ for in_prohibited_table in self .SASLPREP_PROHIBITED
322+ ):
318323 return original_password
319324
320- 321325 # Step 4 of SASLPrep: Bi-directional characters. PostgreSQL follows the
322326 # rules for bi-directional characters laid on in RFC3454 Sec. 6 which
323327 # are:
@@ -327,15 +331,17 @@ cdef class SCRAMAuthentication:
327331 # 3. If the string contains any RandALCat character, an RandALCat
328332 # character must be the first and last character of the string
329333 # RandALCat characters are found in table D.1, whereas LCat are in D.2
330- if any ([ stringprep.in_table_d1(c) for c in normalized_password] ):
334+ if any (stringprep.in_table_d1(c) for c in normalized_password_tuple ):
331335 # if the first character or the last character are not in D.1,
332336 # return the original password
333- if not (stringprep.in_table_d1(normalized_password [0 ]) and
334- stringprep.in_table_d1(normalized_password [- 1 ])):
337+ if not (stringprep.in_table_d1(normalized_password_tuple [0 ]) and
338+ stringprep.in_table_d1(normalized_password_tuple [- 1 ])):
335339 return original_password
336340
337341 # if any characters are in D.2, use the original password
338- if any ([stringprep.in_table_d2(c) for c in normalized_password]):
342+ if any (
343+ stringprep.in_table_d2(c) for c in normalized_password_tuple
344+ ):
339345 return original_password
340346
341347 # return the normalized password
0 commit comments