Collected research
Encoding Differentials: Why Charset Matters
Omitting the charset attribute from a Content-Type header is itself an XSS-enabling defect, because browsers then auto-detect the encoding of the response body. Injecting ISO-2022-JP escape sequences flips the assumed character set: under JIS X 0201 the byte used for backslash escaping renders as a yen sign, defeating quote escaping in JavaScript strings, while the two-byte JIS X 0208 set consumes an attribute's closing quote and breaks HTML context.
Record
- Researcher
- Stefan Schiller
- Published by
- Sonar
- Date
- Topic
- Other
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of Stefan Schiller, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .