[Jsonpath] Roman Danyliw's No Objection on draft-ietf-jsonpath-base-19: (with COMMENT)

[Roman Danyliw via Datatracker <[e-mail]>]

Roman Danyliw has entered the following ballot position for
draft-ietf-jsonpath-base-19: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/ 
for more information about how to handle DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-jsonpath-base/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you to Dan Harkins for the SECDIR review.

** Section 4.2.  Recommend unpacking “translated” to be more specific.

OLD
   These variables need to be translated into the
   form they take in a JSONPath query, e.g., by escaping string
   delimiters, or by only allowing specific constructs such as .name to
   be formed when the given values allow that.

NEW
These input variables will need to be validated against application-specific
constraints (e.g., only allowing specific constructs such as .name to be formed
when the given values allow that) and reformatted (e.g., by escaping string
delimiters).

** Section 4.2.  I found the language of “Availability, Confidentiality, and
Integrity breaches” generic.  Consider:

OLD
  Failure to perform these
   translations correctly can lead to unexpected failures, which can
   lead to Availability, Confidentiality, and Integrity breaches, in
   particular if an adversary has control over the values (e.g., by
   entering them into a Web form).  The resulting class of attacks,
   _injections_ (e.g., SQL injections), is consistently found among the
   top causes of application security vulnerabilities and requires
   particular attention.

NEW
In certain applications (e.g., a web-form), an adversary might be able to
directly control the input into a JSONPath.  Failure to validate and escape
input can result in variety of injection attacks whose result could include
compromise of the endpoint running the application and arbitrary code
execution; corruption or alteration of data assessable to the endpoint (e.g.,
SQL injection); or altering the security context of execution (e.g., XSS).