Text based resources shouldn't start with the BOM character to force UTF-8 encoding

default ASP.NET Core Web Application using Kestrel

• <link rel="stylesheet" href="/css/site.css">
• <script src="/js/site.js?v=ji3-IxbEzYWjzzLCGkF1KDjrT2jLbbrSYXw-AhMPNIA"></script>

Warn if the byte-order mark

[mkArtakMSFT]

Hi @cyberh0me. I'm not sure I understand what the issue is here? Can you please explain?

@mkArtakMSFT please consolidate with @blowdart

[blowdart]

Again, this isn't really security, except for a small case, where the BOM can override encoding declarations, however stripping could also affect SPKI. So my opinion here is minimal.

[molant]

While the BOM can be used to indicate the content is UTF-8, the recommended way is to be explicit and use the headers. Having the BOM in a file can also lead to interop issues with browsers (there are some that look at the headers, others to the BOM). sonarwhal is not the only tool warning about it, ESLint is another one and I'm sure there are more.

The following document from the W3C has more information about the Potential issues with the UTF-8 BOM.

Can you pretty please remove the BOM from your templates? 🙏🏼

[mkArtakMSFT]

@ryanbrandenburg, can you please handle this:

Can you pretty please remove the BOM from your templates? 🙏🏼