Re: [apps-discuss] Concise Binary Object Representation (CBOR)

[Tony Finch <[e-mail]>]

Carsten Bormann <[e-mail]> wrote:
> On May 23, 2013, at 17:35, Nico Williams <[e-mail]> wrote:
>
> > Many a ECMAScript and/or JSON implementation use NaN coding, which is
> > probably why this restriction is there in the first place (though
> > that's just a guess; I'm sure there's a list archive somewhere with a
> > lengthy discussion I could check; I don't care).
>
> Now you lost me -- JSON doesn't have NaNs.
> (Another thing that CBOR has that you can't use in a JSON subset.)

It is probably worth putting something in the security considerations
about NaNs. See for instance
http://article.gmane.org/gmane.comp.lang.lua.general/70705
and http://trac.webkit.org/changeset/64706

Also, the multiple forms of encoding for integers mean that applications
have to be careful how they handle range and equality checks - there's an
analogous problem to the loose UTF-8 parser security bugs.

Tony.
-- 
f.anthony.n.finch  <[e-mail]>  http://dotat.at/
Forties, Cromarty: East, veering southeast, 4 or 5, occasionally 6 at first.
Rough, becoming slight or moderate. Showers, rain at first. Moderate or good,
occasionally poor at first.