Phillip Wood [off-list ref] writes:
I've just had a quick look at that other thread, it would be more
convincing to me if there was some explanation of the security issues
that accepting uppercase object ids causes. While I appreciate brian may
not be able to talk about specific vulnerabilities in particular
products, it would help to outline the security issues in general terms.
In any case, I do not see any new use of istarts_with() in the patch
to deliberately allow upppercase hexadecimal. It is not like there
is an existing machinery that has generated uppercase hexadecimal
for a long time and we need to support their output, or anything
like that.