The fortunate thing is, almost all of the broken sequences are unambiguous enough to be signs that the text should be encoded and then re-decoded as UTF-8. (This is not the case with any arbitrary encoding mixup -- if you mix up Big5 with EUC-JP, you might as well throw out your text and start over -- but it works for UTF-8 and the most common other encodings because UTF-8 is well-designed.)
Missing: how defaults are wrong between UTF8 and EBCDIC. E.g. where a character in UTF8 outside the MES2 subset ('latin1') will be mapped to the x3F 'unknown' character of EBCDIC, which will be mapped back to the x1A character ('CTRL-z') of UTF8...
Lol, biggest bug is developer ignoring that latin1 & unicode encoded in UTF8 can coexists in the same stream of data :
- HTTP 1.1 headers are ISO-8859-1 (CERN legacy) while content can be UTF8
- SIP being based on HTTP RFC have the same flaw.
The CTO of my last VoIP company is still wondering why some callerIDs are breaking his nice python program assuming everything is UTF8 and still does not understand this...
Yes, encoding can change, I also saw it while using regionalisation with C# .net in logs.
Historically, HTTP has allowed field content with text in the
ISO-8859-1 charset [ISO-8859-1], supporting other charsets only
through use of [RFC2047] encoding. In practice, most HTTP header
field values use only a subset of the US-ASCII charset [USASCII].
Newly defined header fields SHOULD limit their field values to
US-ASCII octets. A recipient SHOULD treat other octets in field
content (obs-text) as opaque data.
Though I guess you'd still need to decode it correctly in order to ignore the right characters.
IETF should just publish an RFC that says "all text without a field specifying its encoding shall be UTF-8, even if this conflicts with a previous RFC." The only real objection to doing this is that it would break things, but almost all of those things are already broken.
The problem is browser vendors wouldn't want to implement that spec because if updating your browser breaks the website, no matter how much you explain it to the user, it's your fault, not the website owner's. It's why we have Quirks Mode even after 15 years. It's why Linus is so adamant about patches breaking userspace;[1] if your update broke it, it's your fault, no matter how bad the truly broken thing is.
There are cases where the status quo is already broken and you're already being blamed for it. A change that makes the brokenness 20% instead of 80% by inverting the set of weird websites it happens on is going to make userspace less broken on net.
So if you want a Python library that can do this automatically with an extremely low rate of false positives: https://github.com/LuminosoInsight/python-ftfy