Changeset 209 for draft-ietf-httpbis/latest/p3-payload.html

Timestamp:

12/02/08 13:46:02 (15 years ago)

Author:

julian.reschke@…

Message:

Remove character set defaulting for text media types (to be done: add security considerations WRT charset sniffing); relates to #20.

File:

• draft-ietf-httpbis/latest/p3-payload.html (modified) (7 diffs)

draft-ietf-httpbis/latest/p3-payload.html

@@ -486 +486 @@
          <li class="tocline0">2.&nbsp;&nbsp;&nbsp;<a href="#notation">Notational Conventions and Generic Grammar</a></li>
          <li class="tocline0">3.&nbsp;&nbsp;&nbsp;<a href="#protocol.parameters">Protocol Parameters</a><ul class="toc">
-               <li class="tocline1">3.1&nbsp;&nbsp;&nbsp;<a href="#character.sets">Character Sets</a><ul class="toc">
-                     <li class="tocline1">3.1.1&nbsp;&nbsp;&nbsp;<a href="#missing.charset">Missing Charset</a></li>
-                  </ul>
-               </li>
+               <li class="tocline1">3.1&nbsp;&nbsp;&nbsp;<a href="#character.sets">Character Sets</a></li>
                <li class="tocline1">3.2&nbsp;&nbsp;&nbsp;<a href="#content.codings">Content Codings</a></li>
                <li class="tocline1">3.3&nbsp;&nbsp;&nbsp;<a href="#media.types">Media Types</a><ul class="toc">
@@ -632 +629 @@
       <p id="rfc.section.3.1.p.8">Implementors should be aware of IETF character set requirements <a href="#RFC3629" id="rfc.xref.RFC3629.1"><cite title="UTF-8, a transformation format of ISO 10646">[RFC3629]</cite></a>  <a href="#RFC2277" id="rfc.xref.RFC2277.1"><cite title="IETF Policy on Character Sets and Languages">[RFC2277]</cite></a>.
       </p>
-      <h3 id="rfc.section.3.1.1"><a href="#rfc.section.3.1.1">3.1.1</a>&nbsp;<a id="missing.charset" href="#missing.charset">Missing Charset</a></h3>
-      <p id="rfc.section.3.1.1.p.1">Some HTTP/1.0 software has interpreted a Content-Type header without charset parameter incorrectly to mean "recipient should
-         guess." Senders wishing to defeat this behavior <em class="bcp14">MAY</em> include a charset parameter even when the charset is ISO-8859-1 (<a href="#ISO-8859-1" id="rfc.xref.ISO-8859-1.1"><cite title="Information technology -- 8-bit single-byte coded graphic character sets -- Part 1: Latin alphabet No. 1">[ISO-8859-1]</cite></a>) and <em class="bcp14">SHOULD</em> do so when it is known that it will not confuse the recipient.
-      </p>
-      <p id="rfc.section.3.1.1.p.2">Unfortunately, some older HTTP/1.0 clients did not deal properly with an explicit charset parameter. HTTP/1.1 recipients <em class="bcp14">MUST</em> respect the charset label provided by the sender; and those user agents that have a provision to "guess" a charset <em class="bcp14">MUST</em> use the charset from the content-type field if they support that charset, rather than the recipient's preference, when initially
-         displaying a document. See <a href="#canonicalization.and.text.defaults" title="Canonicalization and Text Defaults">Section&nbsp;3.3.1</a>.
-      </p>
       <h2 id="rfc.section.3.2"><a href="#rfc.section.3.2">3.2</a>&nbsp;<a id="content.codings" href="#content.codings">Content Codings</a></h2>
       <p id="rfc.section.3.2.p.1">Content coding values indicate an encoding transformation that has been or can be applied to an entity. Content codings are
@@ -721 +711 @@
       <p id="rfc.section.3.3.1.p.3">If an entity-body is encoded with a content-coding, the underlying data <em class="bcp14">MUST</em> be in a form defined above prior to being encoded.
       </p>
-      <p id="rfc.section.3.3.1.p.4">The "charset" parameter is used with some media types to define the character set (<a href="#character.sets" title="Character Sets">Section&nbsp;3.1</a>) of the data. When no explicit charset parameter is provided by the sender, media subtypes of the "text" type are defined
-         to have a default charset value of "ISO-8859-1" when received via HTTP. Data in character sets other than "ISO-8859-1" or
-         its subsets <em class="bcp14">MUST</em> be labeled with an appropriate charset value. See <a href="#missing.charset" title="Missing Charset">Section&nbsp;3.1.1</a> for compatibility problems.
+      <p id="rfc.section.3.3.1.p.4">HTTP/1.1 recipients <em class="bcp14">MUST</em> respect the charset label provided by the sender; and those user agents that have a provision to "guess" a charset <em class="bcp14">MUST</em> use the charset from the content-type field if they support that charset, rather than the recipient's preference, when initially
+         displaying a document.
       </p>
       <h3 id="rfc.section.3.3.2"><a href="#rfc.section.3.3.2">3.3.2</a>&nbsp;<a id="multipart.types" href="#multipart.types">Multipart Types</a></h3>
@@ -1203 +1192 @@
          as described by this document. The discussion does not include definitive solutions to the problems revealed, though it does
          make some suggestions for reducing security risks.
+      </p>
+      <p id="rfc.section.8.p.2"> <span class="comment">[sec.charset.sniffing: Point out the risks related to character set sniffing, in particular for UTF-7. See &lt;<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/20#comment:4">http://tools.ietf.org/wg/httpbis/trac/ticket/20#comment:4</a>&gt;.]</span> 
       </p>
       <h2 id="rfc.section.8.1"><a href="#rfc.section.8.1">8.1</a>&nbsp;<a id="privacy.issues.connected.to.accept.headers" href="#privacy.issues.connected.to.accept.headers">Privacy Issues Connected to Accept Headers</a></h2>
@@ -1500 +1491 @@
       <p id="rfc.section.C.2.p.1">Clarify contexts that charset is used in. (<a href="#character.sets" title="Character Sets">Section&nbsp;3.1</a>)
       </p>
-      <p id="rfc.section.C.2.p.2">Remove reference to non-existant identity transfer-coding value tokens. (<a href="#no.content-transfer-encoding" title="No Content-Transfer-Encoding">Appendix&nbsp;A.4</a>)
+      <p id="rfc.section.C.2.p.2">Remove character set defaulting for text media types. (<a href="#canonicalization.and.text.defaults" title="Canonicalization and Text Defaults">Section&nbsp;3.3.1</a>)
+      </p>
+      <p id="rfc.section.C.2.p.3">Remove reference to non-existant identity transfer-coding value tokens. (<a href="#no.content-transfer-encoding" title="No Content-Transfer-Encoding">Appendix&nbsp;A.4</a>)
       </p>
       <h1 id="rfc.section.D"><a href="#rfc.section.D">D.</a>&nbsp;Change Log (to be removed by RFC Editor before publication)
@@ -1537 +1530 @@
       <h2 id="rfc.section.D.3"><a href="#rfc.section.D.3">D.3</a>&nbsp;Since draft-ietf-httpbis-p3-payload-01
       </h2>
-      <p id="rfc.section.D.3.p.1">Ongoing work on ABNF conversion (&lt;<a href="http://www3.tools.ietf.org/wg/httpbis/trac/ticket/36">http://www3.tools.ietf.org/wg/httpbis/trac/ticket/36</a>&gt;): 
+      <p id="rfc.section.D.3.p.1">Ongoing work on text media type charset defaults (&lt;<a href="http://www3.tools.ietf.org/wg/httpbis/trac/ticket/20">http://www3.tools.ietf.org/wg/httpbis/trac/ticket/20</a>&gt;): 
+      </p>
+      <ul>
+         <li>Remove the ISO-8859-1 default.</li>
+      </ul>
+      <p id="rfc.section.D.3.p.2">Ongoing work on ABNF conversion (&lt;<a href="http://www3.tools.ietf.org/wg/httpbis/trac/ticket/36">http://www3.tools.ietf.org/wg/httpbis/trac/ticket/36</a>&gt;): 
       </p>
       <ul>
@@ -1670 +1668 @@
             <li class="indline0"><a id="rfc.index.I" href="#rfc.index.I"><b>I</b></a><ul class="ind">
                   <li class="indline1">identity&nbsp;&nbsp;<a class="iref" href="#rfc.iref.i.1">3.2</a></li>
-                  <li class="indline1"><em>ISO-8859-1</em>&nbsp;&nbsp;<a class="iref" href="#rfc.xref.ISO-8859-1.1">3.1.1</a>, <a class="iref" href="#ISO-8859-1"><b>10.1</b></a></li>
+                  <li class="indline1"><em>ISO-8859-1</em>&nbsp;&nbsp;<a class="iref" href="#ISO-8859-1"><b>10.1</b></a></li>
                </ul>
             </li>