RE: [whatwg] Is EBCDIC support needed for not breaking the Web?

Hixie wrote:

> >
> > Gecko does support UTF-7 and will continue to do so because UTF-7
> is
> > still in use as a character set for mail encoding and multi-part
> MIME
> > documents.
> 
> Would it be possible to limit this support to e-mail? Supporting
> UTF-7 on
> the Web has been the source of security bugs and really doesn't
> seem
> necessary outside of e-mail.
> 

+1

In particular, the *autodetection* of UTF-7 as an encoding in Web pages should be a "MUST NOT" in HTML5, IMHO, because that is a well-known XSS attack. Auto-detection of UTF-7 serves no other purpose in real-world Web documents. I believe there is a TAG finding to this effect. Further, the authors of the UTF-7 RFCs have expressed support for that course of action (as has the I18N WG and, I believe, the UTC).

Best Regards,

Addison

Addison Phillips
Globalization Architect -- Lab126

Internationalization is not a feature.
It is an architecture.

Received on Friday, 29 August 2008 17:17:49 UTC