Subject: Re: Default Charsets

From: Mark Nottingham <[email-masked]>
Date: Tue, 13 Jun 2006 12:10:47 -0700

So... is this an errata?

Are there cases where having this as a default is actually helpful?

On 2006/05/01, at 12:19 PM, Mark Nottingham wrote:

>
>
> 2616 Section 3.7.1 states;
>
>> When no explicit charset parameter is provided by the sender,  
>> media subtypes of the "text" type are defined to have a default  
>> charset value of "ISO-8859-1" when received via HTTP.
>
> However, many, if not all, of the text/* media types define their  
> own defaults; text/plain (RFC2046), for example, defaults to ASCII,  
> as does text/xml (RFC3023).
>
> How do these format-specific defaults interact with HTTP's default?  
> Is HTTP really overriding them?
>
> I'm far from the first to be confused by this text, and I'm sure  
> it's been asked before, but I haven't been able to find a  
> definitive answer. If errata are still being considered, perhaps  
> removing/modifying this line would be a good start...
>
> Thanks,
>
> --
> Mark Nottingham
> [email-masked]
>
>
>
>
>

--
Mark Nottingham
[email-masked]

---

From: "Robert Sayre" <[email-masked]>
Date: Tue, 13 Jun 2006 15:43:13 -0400

> > as does text/xml (RFC3023).

FWIW, Mozilla defaults text/xml to utf-8 (doesn't everyone?), but does
actually use ISO-8859-1/CP-1252 as a default if all else fails,
including sniffing. See

<http://lxr.mozilla.org/seamonkey/source/content/html/document/src/nsHTMLDocument.cpp#831>

for the gory details. Other media types try similar things:

(this link is slow)
<http://landfill.mozilla.org/mxr-test/seamonkey/search?string=AssignLiteral%28%22ISO-8859-1%22>

-- 

Robert Sayre

---

From: "Anne van Kesteren" <[email-masked]>
Date: Tue, 13 Jun 2006 21:55:16 +0200

On Tue, 13 Jun 2006 21:43:13 +0200, Robert Sayre <[email-masked]> wrote:
> FWIW, Mozilla defaults text/xml to utf-8 (doesn't everyone?),

I think everyone does (at least in browser land) and I'm really wondering  
why RFC 3023 and its successor are still stating it should be US-ASCII. So  
useless. Treating it identical to application/xml seems much better... (I  
guess someone gets upset now.)

-- 
Anne van Kesteren
<http://annevankesteren.nl/>
<http://www.opera.com/>

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Tue, 13 Jun 2006 23:16:51 +0200

* Robert Sayre wrote:
>including sniffing.

There are two ways to process text/xml content, either as described for
text/xml in RFC 3023 or as described for application/xml in RFC 3023 and
the XML Recommendations. Last time I checked Mozilla did neither. Great
thing for anyone seeking to exploit code injection vulnerabilities.
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Weinh. Str. 22 · Telefon: +49(0)621/4309674 · http://www.bjoernsworld.de
68309 Mannheim · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: "Robert Sayre" <[email-masked]>
Date: Tue, 13 Jun 2006 17:30:12 -0400

> thing for anyone seeking to exploit code injection vulnerabilities.

Well, that's three ways then, right? :)

I am sure that patches are welcome, but I don't think your message is
relevant to the topic at hand.

-- 

Robert Sayre

"I would have written a shorter letter, but I did not have the time."