[whatwg] base64 entities

[Boris Zbarsky]

On 8/26/10 6:45 PM, Adam Barth wrote:
>> Note that this issue means that using atob or btoa for dealing with this is
>> a huge pain if non-ASCII chars are involved, since those take and return
>> byte arrays masquerading as JS strings, not actual Unicode strings.
>
> I'm slightly confused how that works.  How do you represent arbitrary
> binary data as characters?

You mean how do atob/btoa take their binary data in JS-land?  You take 
your byte array, and convert it to a sequence of two-byte units by 
setting the high byte to 0.  This sequence of two-byte units is a JS string.

> Another option is to provide a base64
> encoder/decoder that uses UTF8 to encode/decode the binary.

Not sure what the exact proposal here is.

> Because<script>  does not decode entities in HTML, the attacker will
> be limited to what he or she can do with alphanumeric characters

OK.  I had misunderstood what you were proposing for <script> here.  The 
point is that inside <script> this base64 thing will only be useful for 
setting innerHTML, right?

-Boris