IETF Logo Mail Archive

Re: [Cellar] Security considerations: recursive elements

"Peter B." <pb@das-werkstatt.com> Thu, 18 January 2018 15:41 UTC

Return-Path: <pb@das-werkstatt.com>
X-Original-To: cellar@ietfa.amsl.com
Delivered-To: cellar@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AA08A124217 for <cellar@ietfa.amsl.com>; Thu, 18 Jan 2018 07:41:26 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.6
X-Spam-Level:
X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZT4yOd09OWGq for <cellar@ietfa.amsl.com>; Thu, 18 Jan 2018 07:41:25 -0800 (PST)
Received: from zucker2.schokokeks.org (zucker2.schokokeks.org [178.63.68.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E92341204DA for <cellar@ietf.org>; Thu, 18 Jan 2018 07:41:24 -0800 (PST)
Received: from [10.0.0.11] (1360030002.d-dsl.at [::ffff:81.16.105.50]) (AUTH: PLAIN bubestinger@schokokeks.org, TLS: TLSv1/SSLv3, 128bits, ECDHE-RSA-AES128-GCM-SHA256) by zucker.schokokeks.org with ESMTPSA; Thu, 18 Jan 2018 16:41:23 +0100 id 000000000000006D.000000005A60C023.000060AE
To: cellar@ietf.org
References: <r470Ps-10116i-3ABCD62B1357486F868D3DB41D62F97E@castor.home>
From: "Peter B." <pb@das-werkstatt.com>
Message-ID: <1f52a329-febb-eb2e-6610-6509990037d3@das-werkstatt.com>
Date: Thu, 18 Jan 2018 16:41:21 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.4.0
MIME-Version: 1.0
In-Reply-To: <r470Ps-10116i-3ABCD62B1357486F868D3DB41D62F97E@castor.home>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
Content-Language: en-US
Archived-At: <https://mailarchive.ietf.org/arch/msg/cellar/LVv2V7vQzU9CYvH8TYS10yjh8Ww>
Subject: Re: [Cellar] Security considerations: recursive elements
X-BeenThere: cellar@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Codec Encoding for LossLess Archiving and Realtime transmission <cellar.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/cellar>, <mailto:cellar-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cellar/>
List-Post: <mailto:cellar@ietf.org>
List-Help: <mailto:cellar-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/cellar>, <mailto:cellar-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 18 Jan 2018 15:41:26 -0000

On 2018-01-18 09:24, Reto Kromer wrote:
> Jerome Martinez wrote:
>
>> "An implementation may set limits on the maximum depth of
>> nesting" in a parser section (similar to JSON RFC).
> I agree, this is up to the single implementations.

Could it be useful to suggest (not define) a "reasonable" value for max
nesting depth there, instead of just saying it "could be limited by an
implementation"?

This might reduce implementation-specific interoperability fluctuations,
I guess.


Just an idea...
Pb

v2.23.0 | Report a Bug | By Email