When parsing URLs, encode the character U+007F DELETE as "%7F". This improves readability, reduces spoofing risk, makes Chrome's behavior more consistent, interoperable with other browsers and compliant with the specification.
- U+7F is the only non-printable ASCII character that is not percent-encoded. One could rely on this for spoofing purpose. - The spec says it should be percent-encoded and WebKit and Gecko does it. - Blink already percent-encode U+7F in URLs in most cases, this change is about making it consistent by handling the same paths of non-special URLs (i.e. using schemes other than ftp, file, http, https, ws, wss) or URL fragments (i.e. #foo).
Status in Chromium
Enabled by default (tracking bug) in:
- Chrome for desktop release 86
- Chrome for Android release 86
- Android WebView release 86
Consensus & Standardization
Last updated on 2021-05-15