708620 - Whine to console when a form is submitted using an encoding that can't represent all of Unicode

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, enhancement)

Description

[Henri Sivonen (:hsivonen)]

See http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2011-November/033991.html

When Web apps that solicit textual input from users transfer the input to the server using an encoding that can't encode all of Unicode, user input (including names of people) may break.

To call Web author attention to this problem, Firefox should whine to console when a form is submitted using an encoding that can't encode all of Unicode and, therefore, can corrupt user input.

Comment 1

[Henri Sivonen (:hsivonen)]

Attachment: Whine to console about form submission encodings that can't encode all of Unicode

GB18030 can encode all of Unicode, so excluding it from the whining. UTF-16 is mapped to UTF-8 before the whining check.

Comment 2

[Henri Sivonen (:hsivonen)]

Attachment: Whine to console about form submission encodings that can't encode all of Unicode

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 582852 [details] [diff] [review]
Whine to console about form submission encodings that can't encode all of Unicode

This can be a bit noisy, but is an important thing.

Comment 4

[Henri Sivonen (:hsivonen)]

Thanks for the r.

https://hg.mozilla.org/integration/mozilla-inbound/rev/f4f47800d2ff

Comment 5

[Marco Bonardo [:mak]]

https://hg.mozilla.org/mozilla-central/rev/f4f47800d2ff

Comment 6

[Masatoshi Kimura [:emk]]

(In reply to Henri Sivonen (:hsivonen) from comment #0)
> See
> http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2011-November/033991.html
> 
> When Web apps that solicit textual input from users transfer the input to
> the server using an encoding that can't encode all of Unicode, user input
> (including names of people) may break.
Actually it is a problem of poorly-written server-side software as the reply says. If the encoding  can not represent a character, the character will be converted to character reference. Server-side software can handle to repair the original character. If the form encoding is changed to UTF-8, server-side software (and all existing data) needs to be updated anyway. I doubt it deserves a warning.

Comment 7

[Henri Sivonen (:hsivonen)]

(In reply to Masatoshi Kimura [:emk] from comment #6)
> If the form encoding is changed to UTF-8,
> server-side software (and all existing data) needs to be updated anyway.

Yes, the server needs fixing, too. It doesn't make sense to fix just the form.

Maybe the wording needs to be tweaked to make this clear?

Comment 8

[Henri Sivonen (:hsivonen)]

Oh, and the server cannot unambigously repair submission where something has been converted to character references, because it can't tell if substrings that look like character references are user input or artifacts of lossy conversion.