Editing UTF-7 (section)

==Security==
UTF-7 allows multiple representations of the same source string. In particular, ASCII characters can be represented as part of Unicode blocks. As such, if standard ASCII-based escaping or validation processes are used on strings that may be later interpreted as UTF-7, then Unicode blocks may be used to slip malicious strings past them. To mitigate this problem, systems should perform decoding before validation and should avoid attempting to autodetect UTF-7.

Older versions of [[Internet Explorer]] can be tricked into interpreting the page as UTF-7. This can be used for a [[cross-site scripting]] attack as the <code>&lt;</code> and <code>&gt;</code> marks can be encoded as <code>+ADw-</code> and <code>+AD4-</code> in UTF-7, which most validators let through as simple text.<ref>{{cite web|url=https://code.google.com/p/doctype-mirror/wiki/ArticleUtf7 |title=ArticleUtf7 - doctype-mirror - UTF-7: the case of the missing charset - Mirror of Google Doctype - Google Project Hosting |date=2011-10-14 |access-date=2012-06-29}}</ref>

UTF-7 is considered obsolete, at least for Microsoft software (.NET), with code paths previously supporting it intentionally broken (to prevent security issues) in .NET 5, in 2020.<ref name="dotnet5">{{Cite web|title=Breaking change: UTF-7 code paths are obsolete|url=https://docs.microsoft.com/en-us/dotnet/core/compatibility/core-libraries/5.0/utf-7-code-paths-obsolete|access-date=2021-01-08|website=docs.microsoft.com|language=en-us}}</ref>