{"action":"created","issue":{"url":"https://api.github.com/repos/whatwg/encoding/issues/15","labels_url":"https://api.github.com/repos/whatwg/encoding/issues/15/labels{/name}","comments_url":"https://api.github.com/repos/whatwg/encoding/issues/15/comments","events_url":"https://api.github.com/repos/whatwg/encoding/issues/15/events","html_url":"https://github.com/whatwg/encoding/issues/15","id":116711200,"number":15,"title":"iso-2022-jp encoder XSS risks","user":{"login":"t-tera","id":15522767,"avatar_url":"https://avatars.githubusercontent.com/u/15522767?v=3","gravatar_id":"","url":"https://api.github.com/users/t-tera","html_url":"https://github.com/t-tera","followers_url":"https://api.github.com/users/t-tera/followers","following_url":"https://api.github.com/users/t-tera/following{/other_user}","gists_url":"https://api.github.com/users/t-tera/gists{/gist_id}","starred_url":"https://api.github.com/users/t-tera/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/t-tera/subscriptions","organizations_url":"https://api.github.com/users/t-tera/orgs","repos_url":"https://api.github.com/users/t-tera/repos","events_url":"https://api.github.com/users/t-tera/events{/privacy}","received_events_url":"https://api.github.com/users/t-tera/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":12,"created_at":"2015-11-13T06:41:12Z","updated_at":"2015-12-15T21:56:08Z","closed_at":null,"body":"https://encoding.spec.whatwg.org/#iso-2022-jp-encoder\r\n\r\n> 13\\.2\\.2 iso\\-2022\\-jp encoder\r\n\r\nSuppose the input unicode string is A, B, ESC, $, B, 1, 2.\r\n\r\nIn this case, resulting encoded bytes will be A, B, ESC, $, B, 1, 2, according to the current spec.\r\n\r\nThe byte sequence can be, when decoded again, a unicode string A, B, 憶, which is apparently different from the original input unicode string.\r\n\r\nThe point I am making here is that, when encoding, ESC chars in the input unicode string should be specially handled (removed or replaced with something else). Or am I misunderstanding something?\r\n\r\nThanks,\r\nTakeshi"},"comment":{"url":"https://api.github.com/repos/whatwg/encoding/issues/comments/164909419","html_url":"https://github.com/whatwg/encoding/issues/15#issuecomment-164909419","issue_url":"https://api.github.com/repos/whatwg/encoding/issues/15","id":164909419,"user":{"login":"peteroupc","id":2554980,"avatar_url":"https://avatars.githubusercontent.com/u/2554980?v=3","gravatar_id":"","url":"https://api.github.com/users/peteroupc","html_url":"https://github.com/peteroupc","followers_url":"https://api.github.com/users/peteroupc/followers","following_url":"https://api.github.com/users/peteroupc/following{/other_user}","gists_url":"https://api.github.com/users/peteroupc/gists{/gist_id}","starred_url":"https://api.github.com/users/peteroupc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/peteroupc/subscriptions","organizations_url":"https://api.github.com/users/peteroupc/orgs","repos_url":"https://api.github.com/users/peteroupc/repos","events_url":"https://api.github.com/users/peteroupc/events{/privacy}","received_events_url":"https://api.github.com/users/peteroupc/received_events","type":"User","site_admin":false},"created_at":"2015-12-15T21:56:08Z","updated_at":"2015-12-15T21:56:08Z","body":"I should note that ASCII defines a character called SUB (byte 0x1A, the \"substitute character\"), which serves a similar purpose as the Unicode replacement character.  This byte could be another possible choice when encoding U+000E, U+000F, and the like."}}