Re: [w3c/browser-payment-api] Spec prohibits currency validation but doesn't define what it is (#175)

Parsing this would be fine. We can improve the security of our
implementations by:

* Constraining to a reasonable length, for example 2048 bytes.
* Defining a format for the longer messages. For example, allowing only URL
format.

--Rouslan

On Tue, May 17, 2016, 6:04 AM ianbjacobs <notifications@github.com> wrote:

> @adamroach <https://github.com/adamroach>,
>
> I am ok with this and it seems developer friendly. Do implementers see too
> much parsing complexity?
>
> Ian
>
> —
> You are receiving this because you are subscribed to this thread.
> Reply to this email directly or view it on GitHub
> <https://github.com/w3c/browser-payment-api/issues/175#issuecomment-219710870>
>


---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/browser-payment-api/issues/175#issuecomment-219752553