Re: [apps-discuss] Working Group Last Call on draft-ietf-appsawg-multipart-form-data

[Ned Freed <[e-mail]>]

> I am acting as shepherd for the appsawg-mutlipart-form-data

> The wg lc for this draft has been issued on September 16, but since then nobody has sent
> any comment/feedback to the list.

> We really need people reviewing this document and providing their feedback
> in order to determine if there is or not working group consensus to be publish this draft.

A few comments.

The wording in section 5.1 is a little odd. Quotes are only required
around parameter values when a tspecial character is present. But the way
this section is worded makes it sound like parameters always have to be
quoted and systems that emit an unquoted parameter are doing something
that's at a minimum wierd if not downright incorrect. I don't have
alternate wording to suggest, but some clarification would be good.

I question the need to reference RFC 1806 in section 5.2. RFC 2183  is the
standards-track specification of content-disposition which replaced the
experimental RFC 1806. (OTOH, the documents say that RFC 2183 updates RFC 1806;
I don't understand why it didn't obsolete it. So maybe there's some need to
reference it...)

Section 5.2 makes use of the content-disposition "name" parameter. When I
checked the IANA registry for this parameter
(http://www.iana.org/assignments/cont-disp/cont-disp.xhtml#cont-disp-2) I
noticed something odd: The parameter is supposedly defined in RFC 2388, which
is the earlier version of this document. Moreover, RFC 2388 just talks about
the parameter, it doesn't actually say it registers it.

I suggest adding appropriate registration text to the IANA Considerations
section and updating the registry to point to this document.

Section 5.9 talks about what MIME fields are supported in form data parts,
but doesn't go so far as to say they MUST NOT be present. It might be
a good thing to clarify whether they are simply ignored if present or whether
they might actually screw things up if you include them.

Section 8 and/or the security considerations in section 9 probably should
say something about privacy and integirty protection for form data.

All media types are supposed to state whether or not they involve executable
content, so this needs to be mentioned in section 9.

That's it.

				Ned