David,
You were concerned about the various security issues that result when IRIs
are presented to people in a form where there is spoofing based on different
Unicode characters having the same glyph.
[RFC3987] on IRIs does go into that at length. However, they really don't
apply to the format or what is acceptable as an IRI as much as to input and
presentation practices that help people avoid various confusions and
pitfalls. I think our invocation of [RFC3987] and the provision that IRI in
the OpenFormula grammar must be an IRI-reference in conformance with the XML
Schema anyURI data type should cover it.
I'll provide something more chewy for Part 2 under JIRA Issue OFFICE-3342
when I finish checking some further details.
- Dennis
