Subject: draft-reschke-rfc2231-in-http security considerations

From: Graham Klyne <[email-masked]>
Date: Fri, 19 Feb 2010 09:02:48 +0000

Reviewing:
http://www.ietf.org/id/draft-reschke-rfc2231-in-http-09.txt

I note that the security considerations section says nothing about possible 
character "spoofing" - i.e. making a displayed prompt or value appear to be 
something other than it is.  E.g. Non-ASCII characters have been used to set up 
exploits involving dodgy URIs that may appear to a user to be legitimate.

#g

---

From: Julian Reschke <[email-masked]>
Date: Tue, 23 Feb 2010 17:23:04 +0100

On 19.02.2010 10:02, Graham Klyne wrote:
> I note that the security considerations section says nothing about
> possible character "spoofing" - i.e. making a displayed prompt or value
> appear to be something other than it is. E.g. Non-ASCII characters have
> been used to set up exploits involving dodgy URIs that may appear to a
> user to be legitimate.
> ...

Good catch.

Would the following work for you?

-- snip --
5.  Security Considerations

    The format described in this document makes it possible to transport
    non-ASCII characters, and thus enables character "spoofing"
    scenarios, in which a displayed value appears to be something other
    than it is.

    Furthermore, there are known attack scenarios relating to decoding
    UTF-8.

    See Section 10 of [RFC3629] for more information on both topics.
-- snip --

Best regards, Julian