Re: [Json] Proposed minimal change for duplicate names in objects

[Tatu Saloranta <[e-mail]>]

On Sun, Jul 7, 2013 at 11:57 AM, Bjoern Hoehrmann <[e-mail]> wrote:

> * Tatu Saloranta wrote:
> >If this aspect was lost due to clarification for solving a problem that
> has
> >more to do with concerns for _possible_ security issues, that would be
> sad.
> >
> >End users rarely have real need for minimal-state parsing. It is
> >framework-builders -- such as, say Solr, Elastic Search, Hadoop, JAX-RS
> >implementations (these for Java, similar for other platforms) -- that care
> >as performance implications there have more effect. And they are the ones
> >that have legitimate use for minimal-state components.
>
> Note that the performance implications can easily become security impli-
> cations. A naive implementation of checking for duplicates may well be
> vulnerable to algorithmic complexity attacks causing denial of service
> (by using maliciously crafted input that exhibits worst-case behavior).
>
> http://events.ccc.de/congress/2011/Fahrplan/events/4680.en.html for in-
> stance surprisingly showed that many common environments had failed to
> pay attention when the problem was addressed in Perl eight years prior.
>
>
Yes, good point.

-+ Tatu +-