[Bug 21275] [Imports]: Force utf-8

https://www.w3.org/Bugs/Public/show_bug.cgi?id=21275

--- Comment #24 from Morrita Hajime <morrita@google.com> ---
(In reply to Anne from comment #23)
> No, XMLHttpRequest does that due to legacy. There should be no way to pick
> anything outside utf-8. That is what we have for workers, WebVTT, and
> anything new. Allowing other encodings is a security hazard best avoided.

On the other hand, there is a risk that bad script could let the UA load
existing non-UTF-8 HTML using UTF-8, that seems bad as well. Probably we should
stop with an error if the UA sees non-UTF charset in Content-Type header.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.

Received on Monday, 17 March 2014 19:28:03 UTC