Hixie wrote: > > > > Gecko does support UTF-7 and will continue to do so because UTF-7 > is > > still in use as a character set for mail encoding and multi-part > MIME > > documents. > > Would it be possible to limit this support to e-mail? Supporting > UTF-7 on > the Web has been the source of security bugs and really doesn't > seem > necessary outside of e-mail. > +1 In particular, the *autodetection* of UTF-7 as an encoding in Web pages should be a "MUST NOT" in HTML5, IMHO, because that is a well-known XSS attack. Auto-detection of UTF-7 serves no other purpose in real-world Web documents. I believe there is a TAG finding to this effect. Further, the authors of the UTF-7 RFCs have expressed support for that course of action (as has the I18N WG and, I believe, the UTC). Best Regards, Addison Addison Phillips Globalization Architect -- Lab126 Internationalization is not a feature. It is an architecture.Received on Friday, 29 August 2008 17:17:47 GMT
This archive was generated by hypermail 2.2.0+W3C-0.50 : Tuesday, 2 June 2009 19:17:18 GMT