Re: [clue] Kathleen Moriarty's Discuss on draft-ietf-clue-data-model-schema-14: (with DISCUSS)

[[e-mail]]

Sent from my iPhone

> On Jun 3, 2016, at 7:02 AM, Simon Pietro Romano <[e-mail]> wrote:
> 
> Hello Kathleen,
> 
> as far as point 2 below is concerned:
> 
>>>> 2. Schema drafts tend to cover the need for well-formed schemas as part
>>>> of the security considerations.  Can you add something in about that (not
>>>> much is required, but it's good for implementers to know this is
>>>> important)?  You can see two recent examples for guidance:
>>>> YANG - https://datatracker.ietf.org/doc/draft-ietf-netmod-rfc6020bis/
>>>> IODEF - https://datatracker.ietf.org/doc/draft-ietf-mile-rfc5070-bis/
> 
> …are you sure this is really needed? This seems definitely pleonastic to me. This said, if you think we’d better explicitly mention such a point, would you be ok with the following text
> (entirely borrowed from the YANG RFC)?
> 
> "XML parsers need to be robust with respect to malformed documents. Reading malformed documents from unknown or untrusted sources could result in an attacker gaining 
> privileges of the user running the XML parser. In an extreme situation, the entire machine could be compromised.”

Yes, this would be very good.  I liked the text in that document, hence the reference.

Thanks,
Kathleen 

> 
> Thanks,
> 
> Simon
> 
> 
> 
> 
> 
>                                                _\\|//_
>                                                 ( O-O )
>   ~~~~~~~~~~~~~~~~~~~~~~o00~~(_)~~00o~~~~~~~~~~~~~~~~~~~~~~~~
>                                    Simon Pietro Romano
>                              Universita' di Napoli Federico II
>                             Computer Engineering Department 
>                 Phone: [phone] -- Fax: [phone]
>                                           e-mail: [e-mail]
> 
>            <<Molti mi dicono che lo scoraggiamento è l'alibi degli 
>            idioti. Ci rifletto un istante; e mi scoraggio>>. Magritte.
>                                                oooO
>  ~~~~~~~~~~~~~~~~~~~~~~~(   )~~~ Oooo~~~~~~~~~~~~~~~~~~~~~~~~~
>                                     \ (            (   )
>                                              \_)          ) /
>                                                                       (_/
> 
> 
> 
> 
> 
>