Re: [encoding] iso-2022-jp encoder XSS risks (#15)

> If we return U+FFFD, that ends up being emitted as an "HTML entity" but I suppose that's fine.

Yes. I expect the NCR for U+FFFD to be generally non-dangerous.

> any thoughts on also having that treatment for U+000E and U+000F?

Considering @t-tera's comment about IE earlier, let's return error with U+FFFD for those, too.

---
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/encoding/issues/15#issuecomment-174521104

Received on Monday, 25 January 2016 14:20:36 UTC