Re: [Cbor] Handling duplicate map keys

[Laurence Lundblade <[e-mail]>]

Hi Michael

> On Nov 25, 2019, at 12:02 AM, Michael Richardson <[e-mail]> wrote:
> 
> 
> Laurence Lundblade <[e-mail]> wrote:
>> My intention was that “pass all items up” covers your case.
> 
> python, ruby, lua, java, etc. dictionaries can not "pass all items up"
> The reason why JSON is so successful is because it maps into native
> dictionaries (maps) trivially.

Yes, they fall into one of the other two categories:
- They do duplicate checking and return an error
- They return no error and are either take first, take last or take random

> 
> In order to pass things up, a different structure will be necessary,
> at which point many developers and protocol designers will see no value in
> CBOR over a bespoke binary encoding.
> 
> It is this refusal to define a specific algorithm for dealing with duplicates
> that is leading to security issues.  It's not the duplicates themselves that
> is the problem, it is the ambiguity.
> 
> I am less afraid to declare an answer and make some decoders non-compliant.
> I think that they will get fixed.

I would hope fix them means that they will error out when a duplicate is detected.

It probably doesn’t cost any more than take first and is the more clear, clean and secure thing to do IMO.

Seems like it will be easier to get agreement on that behavior than take first. Also, there will always be some implementations that error out. We can’t get them all to do take first.

LL