Declare Character Encoding
ID |
html.character_encoding |
Severity |
low |
Remediation Complexity |
low |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Reliability |
Language |
Html |
Tags |
reliability |
Description
Flags a document whose <head> declares no character encoding, through neither a
<meta charset> nor a <meta http-equiv="content-type">.
Rationale
A page that does not state its encoding leaves the browser to guess, which mangles non-ASCII text and, with some legacy heuristics, opens a small cross-site-scripting surface. Declaring the encoding explicitly makes rendering deterministic across browsers.
<head> <!-- FLAW — no encoding declared -->
<title>Hi</title>
</head>
<head> <!-- OK — charset declared -->
<meta charset="utf-8">
</head>
<head> <!-- OK — http-equiv form -->
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>