Re: [clue] Kathleen Moriarty's Discuss on draft-ietf-clue-data-model-schema-14: (with DISCUSS)

[Simon Pietro Romano <[e-mail]>]

Hello Kathleen,

as far as point 2 below is concerned:

>>> 2. Schema drafts tend to cover the need for well-formed schemas as part
>>> of the security considerations.  Can you add something in about that (not
>>> much is required, but it's good for implementers to know this is
>>> important)?  You can see two recent examples for guidance:
>>> YANG - https://datatracker.ietf.org/doc/draft-ietf-netmod-rfc6020bis/
>>> IODEF - https://datatracker.ietf.org/doc/draft-ietf-mile-rfc5070-bis/

…are you sure this is really needed? This seems definitely pleonastic to me. This said, if you think we’d better explicitly mention such a point, would you be ok with the following text
(entirely borrowed from the YANG RFC)?

"XML parsers need to be robust with respect to malformed documents. Reading malformed documents from unknown or untrusted sources could result in an attacker gaining 
privileges of the user running the XML parser. In an extreme situation, the entire machine could be compromised.”

Thanks,

Simon





                     					       _\\|//_
                           				      ( O-O )
   ~~~~~~~~~~~~~~~~~~~~~~o00~~(_)~~00o~~~~~~~~~~~~~~~~~~~~~~~~
                    				Simon Pietro Romano
             				 Universita' di Napoli Federico II
                		     Computer Engineering Department 
	             Phone: [phone] -- Fax: [phone]
                                           e-mail: [e-mail]

		    <<Molti mi dicono che lo scoraggiamento è l'alibi degli 
		    idioti. Ci rifletto un istante; e mi scoraggio>>. Magritte.
               			                     oooO
  ~~~~~~~~~~~~~~~~~~~~~~~(   )~~~ Oooo~~~~~~~~~~~~~~~~~~~~~~~~~
					                 \ (            (   )
			                                  \_)          ) /
                                                                       (_/