Re: [hybi] Extensibility mechanisms?

[John Tamplin <[e-mail]>]

On Thu, Jul 22, 2010 at 11:07 AM, Mike Belshe <[e-mail]> wrote:

> BTW - Isn't the creation of this problem really because we allow arbitrary
> UTF-8 written by the JS application?  If we had a true framing layer (where
> frames have headers, instead of allowing UTF-8), would these attacks be
> real?  It seems to me that the simplest frame header would be sufficient to
> prevent all of these attack vectors, but the frame headers could contain
> nonces or whatever other security information is needed too.
>
> The reason I mention this is because as we look to using a TLS/NPN, we can
> potentially get rid of the first round trip.  There was a lot of support for
> that idea within the group.  But, we can *only* do so if we don't have JS
> able to write directly to the socket.  If JS is able to write UTF-8 to the
> socket, then skipping the first round trip opens a security vulnerability as
> depicted by Maciej & Adam here.
>

The JS API just has strings.  It is up to the browser to convert these
strings into UTF8 sequences for the protocol.  If current experience is any
guide, there will be differences among browsers, particularly regarding
non-BMP characters and combining marks.

-- 
John A. Tamplin
Software Engineer (GWT), Google