When parsing URLs, encode the character U+7F DELETE as "%7F". This improves readability, reduces spoofing risk, makes Chrome's behavior more consistent, interoperable with other browsers and compliant with the specification.
- U+7F is the only non-printable ASCII character that is not percent-encoded. One could rely on this for spoofing purpose. - The spec says it should be percent-encoded and WebKit and Gecko does it. - Blink already percent-encode U+7F in URLs in most cases, this change is about making it consistent by handling the same paths of non-special URLs (i.e. using schemes other than ftp, file, http, https, ws, wss) or URL fragments (i.e. #foo).
Status in Chromium
In development (tracking bug)
Consensus & Standardization
Last updated on 2021-01-13