Re: [Cbor] Do we care about array-tags issue 6, clamped-uint8 arrays?

Chairs:

We are expecting that Carsten will provide a pull request with the suggested Security Considerations changes to deal with this issue:

As Individual: 
See below.

-----Original Message-----
From: CBOR <cbor-bounces@ietf.org> On Behalf Of Carsten Bormann
Sent: Thursday, July 25, 2019 10:07 PM
To: Jeffrey Yasskin <jyasskin@google.com>
Cc: cbor@ietf.org; Sean Leonard <dev+ietf@seantek.com>
Subject: Re: [Cbor] Do we care about array-tags issue 6, clamped-uint8 arrays?

On Jul 25, 2019, at 16:36, Jeffrey Yasskin <jyasskin@google.com> wrote:
> 
> I remain
> uncomfortable with having a serialization format describe behaviors 
> that the data had or should have when it was or is loaded into a 
> program.

I don’t know how to avoid that.  If the input is an array, in most generic decoders I get an array to work from.  If the input is instead a map, I get a map (or a JavaScript object); that has quite different behavior.  So the supplier of the input already has a lot of control over the data structures that are input to my system.  Uint8ClampedArray just adds a slight twist to that as it might look too much like a Uint8Array.
None of this relieves an application of validating its input — with a standard serialization format and a robust generic decoder, this can now simply be done on a higher level.

[JLS]  In many respects I kind of agree with Carsten on this.   When I look at this I have a hard time distinguishing between this case and some of the other cases where similar rules are also being required.  For example, if you tag something as UTF-8 or as MIME, the sender is controlling how both the generic decoder and the application are supposed to handle this information.   If I created a tag which defined a subset of UTF-8 then this would be even more true.   For my application both Uint8ClampedArray and Uint8Array would be placed in the same data structure type as I don't have a native type for clamped arrays.  There are then rules on how I manipulate the data.  The same is true for the subset of UTF-8.  This is going to be put into a native format for my machine - maybe UTF16 since that is the native C# data type - but there are still rules on what can be done with the data and how it can be changed.  The application is not permitted to place items in the string which do not match the legal subset of strings allowed.

Jim

Grüße, Carsten

_______________________________________________
CBOR mailing list
CBOR@ietf.org
https://www.ietf.org/mailman/listinfo/cbor