How to defend against invalid UTF7/8 that hides a