Re: [Json] Proposed minimal change for duplicate names in objects

[Bjoern Hoehrmann <[e-mail]>]

* Tatu Saloranta wrote:
>If this aspect was lost due to clarification for solving a problem that has
>more to do with concerns for _possible_ security issues, that would be sad.
>
>End users rarely have real need for minimal-state parsing. It is
>framework-builders -- such as, say Solr, Elastic Search, Hadoop, JAX-RS
>implementations (these for Java, similar for other platforms) -- that care
>as performance implications there have more effect. And they are the ones
>that have legitimate use for minimal-state components.

Note that the performance implications can easily become security impli-
cations. A naive implementation of checking for duplicates may well be
vulnerable to algorithmic complexity attacks causing denial of service
(by using maliciously crafted input that exhibits worst-case behavior).

http://events.ccc.de/congress/2011/Fahrplan/events/4680.en.html for in-
stance surprisingly showed that many common environments had failed to
pay attention when the problem was addressed in Perl eight years prior.
-- 
Björn Höhrmann · mailto:[e-mail] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: [phone] · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/