W3C home > Mailing lists > Public > public-rdf-comments@w3.org > May 2013

Re: \u0000 in literals?

From: David Booth <david@dbooth.org>
Date: Mon, 20 May 2013 14:27:13 -0400
Message-ID: <519A6B01.8070004@dbooth.org>
To: Eric Prud'hommeaux <eric@w3.org>
CC: Alex Milowski <alex@milowski.com>, "public-rdf-comments@w3.org" <public-rdf-comments@w3.org>
On 05/20/2013 01:55 PM, Eric Prud'hommeaux wrote:
> Currently, \u0000 is legal in Turtle (and SPARQL) both in escaped and
> raw form.

Ugh.  Is there really a need to allow the NULL character in a string? 
This seems like it is unnecessarily asking for trouble, given that: (a) 
Turtle is designed to be semantic-web-friendly, to be used on the web; 
and (b) NULL characters in strings can lead to security vulnerabilities, 
because of the long history of NULL as a string terminator.

I imagine this was discussed already.  But were the security 
implications adequately considered?

Received on Monday, 20 May 2013 18:27:44 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 16:59:33 UTC