- From: Martin Thomson <martin.thomson@gmail.com>
- Date: Sat, 21 Feb 2015 22:17:35 +1300
- To: Anne van Kesteren <annevk@annevk.nl>
- Cc: Jonas Sicking <jonas@sicking.cc>, WebAppSec WG <public-webappsec@w3.org>, WebApps WG <public-webapps@w3.org>
On 21 February 2015 at 20:43, Anne van Kesteren <annevk@annevk.nl> wrote: > High-byte of what? A URL is within ASCII range when it reaches the > server. This is the first time I hear of this. Apparently, all sorts of muck floats around the Internet. When we did HTTP/2 we were forced to accept that header field values (URLs in particular) were a sequence of octets. Those are often interpreted as strings in various interesting ways. I wouldn't *completely* discount the potential for the conversions Jonas mentions here. A Java server might parse UTF-8 into the internal UTF-16 representation and then who knows what happens next.
Received on Saturday, 21 February 2015 09:18:02 UTC