Charset Mismatch

When there’s charset mismatch between the HTTP header and content body web browsers can be forced into an undesirable content-sniffing mode to determine content’s correct character set.

An attacker could manipulate content on the page to be interpreted in an encoding of their choice. If an attacker can control content at the beginning of the page, they could inject script using UTF-7 encoded text and manipulate some browsers into interpreting that text.

Force UTF-8 for all text content in both the HTTP header and meta tags in HTML or encoding declarations in XML.

ScanRepeat identifies HTTP responses where the ‘Content-Type’ header declares a charset different from the charset defined in the XML encoding declaration. It reports every occurrence of this kind of mismatch, giving the url and the encoding declarations which have been found.