Re: [ietf-types] Review of application/ccmp+xml

[Ned Freed <[e-mail]>]

> * Ned Freed wrote:
> >>    Optional parameters:  charset
> >>       Indicates the character encoding of enclosed XML for which the
> >>       default is UTF-8.
> >>    Encoding considerations:  Uses XML, which can employ 8-bit
> >>       characters, depending on the character encoding used.  See RFC
> >>       3023 [RFC3023], section 3.2.
> >
> >What you have here is OK, but I note that all of the examples in the draft use
> >utf-8 and have the charset embedded in the content. If utf-8 is all that's ever
> >used, perhaps it would be better just to state that and get rid of all the
> >variability here.

> The charset parameter (and defining it exactly as it is defined for the
> application/xml media type) is necessary if you want implementations of
> only this type agree with general purpose software on what the encoding
> is. Disagreement about what the character encoding is is a typical se-
> curity vulnerability.
                                                                               
I'm sorry, but I believe a much bigger potential security vulnerability is
introduced by the potential of there being a silly state difference between the
character encoding listed in the XML proper and what's in the charset
parameter.

In other words, I believe the suggestions given in RFC 3023 are seriously off
the mark.

But the way to migitate all of this is to Just Use UTF-8. Which is why I wrote
what I wrote - there is no need for a parameter if only one charset is allowed.

				Ned