3 ms·
And to a programmer, what matters is whether the encoding is present and correct. From a security perspective, if you don't include the right encoding meta-dat
by wisty 15y ago
And to a programmer, what matters is whether the encoding is present and correct.
From a security perspective, if you don't include the right encoding meta-data, an attacker can include an XSS attack in UTF-7. Your server reads normal (but gibberish) ASCII, escapes it properly, then shleps it to the client who thinks it's UTF-7 (because of all the UTF-7 chars) and suddenly they are running malicious javascript that you didn't escape.
If you're scraping sites, the one thing more annoying than trying to guess the encoding, and that's dealing with multiple encodings in the same document.
Putting UTF-8 characters in a document doesn't mean you are using "Unicode". It means you are using some undeclared encoding, which is not a step forwards.
- wladimir 15y agoRe: UTF-7, is anyone on the world actually using that? I've only ever read about it in articles about security problems.
- robin_reala 15y agoCertainly not on the web, it’s disallowed in the HTML5 spec: User agents must not support the CESU-8, UTF-7, BOCU-1 and SCSU encodings. and major browsers removed support, e.g.: https://bugzilla.mozilla.org/show_bug.cgi?id=414064 https://bugzilla.mozilla.org/show_bug.cgi?id=414064
- dmbaggett 15y agoNot sure if this "counts," but it is still used to encode IMAP folder names. (Technically, the IMAP version is slightly different from standard UTF-7.)
- chimeracoder 15y agoI'm confused by that as well. I never really understood the motivation behind it - though I guess it's obsolescent, so hopefully it'll soon be just another one of those amusing anachronisms we see occasionally in computer science.
- eridius 15y agoAs I understand it, the motivation was to be able to transmit Unicode text over a channel that's only 7-bit safe (e.g. mail protocols) without having to do something silly like Base64-encoding the whole thing.