[Cosmo-dev] Bug 11081

[Jared Rhine]

Travis Vachon wrote:
> Finally, we need some input from the bug council as to when this fix 
> should land. If we want to go for 0.8 we'll need to roll another rc. I 
> could probably have this fix ready by the end of today. Given how rare 
> these characters appear to be in the wild, I don't think it would be a 
> disaster to wait for 0.9 to roll this out.

We discussed on IRC "be strict about what you send and liberal in what 
you accept" applies.  Of the two, starting with the server-side fix 
seems best here.  You needing to run through the Java dependency cycle 
once for kicks seems a feature not a bug of this approach.

I'd tend to lean towards a more considered checkin for the fix (ala for 
0.9) by adding extra tests in this area, in as many components as 
possible: probably server unit tests, JS units, and hopefully some 
Windmill tests too.  You could no doubt get a healthy fix in today too, 
but I've no problems waiting.

If we patch a library, eventually we'll want to fix upstream and pull 
the patches, so "extra" tests will help us validate this whole area later.

A later approach also allows for our fixes to be informed by Crockford, 
et al.

-- Jared