Re: [apps-discuss] Review of: draft-yevstifeyev-abnf-separated-lists-02

[Dave CROCKER <[e-mail]>]

On 12/11/2010 2:50 AM, Mykyta Yevstifeyev wrote:
> Hello all,
>
> Some notes:
>
> Firstly, this is a review of -02 version and many issues have been
> corrected in -03 one.

However I raised a number of questions and concerns that do not appear to be 
resolved in the new version.

Since the number of comments in the review is not all that large, it would be 
helpful to see responses to each, even for those having the response "resolved 
in -03."  That will make it easy for readers to form their own opinions about 
the resolutions.


>>> 3. Security Considerations
>>>
>>> Security issues are not discussed by this document.
>>
>> A notation that can create obscure effects might well introduce security
>> holes. That's an issue that is not specific to this document, but I wonder
>> whether it isn't time to raise this point in the Considerations sectin?
> How can a simple notation have any security consideration?

Whether it is simple is not the point.  The point is that a meta-syntax that 
makes syntax specifications less clear can make it legal to have data in forms 
that might not have been intended or desired.  This can, in turn, allow in types 
of data that are potentially dangerous.  This is often a problem with space, for 
example, which seeks to bypass filters.

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net