[media-types] [IANA #1456008] application/prs.ktb+zip registration request

[Amanda Baber via RT <[e-mail]>]

Hi Darrel,

Resending this revised sec cons section from September 29th.

thanks,
Amanda

On Tue Sep 29 19:24:18 2026, amanda.baber wrote:
> Hi Darrel,
> 
> Does this updated sec cons section work?
> 
> ===
> 
> Security considerations:
> 
> (1) the format contains html which can contain embedded javascript,
> the applications that implement it should ignore embedded javascript
> and only parse html and css.
> 
> (2) The format does not use privacy or integrity services by itself
> internally, because documents can contain private information,
> ensuring the privacy and security of the documents is the
> responsibility of the implementing applications and end users.
> 
> (3) It inherits all security considerations of JSON and ZIP archives.
> Implementing apps should use robust json parsers and guard against
> malicious attacks like zip bombs and path traversal attacks.
> 
> (4) The document may contain html hyperlinks, it is the apps
> responsibility to make accidental opening of the links less common
> like using ctrl + left mouse click to enter the link, showing a
> confirmation dialog, or both, and it is the end user's responsibility
> to not enter malicious links.
> 
> ===
> 
> thanks,
> Amanda
> 
> On Sun Sep 20 15:27:20 2026, [e-mail] wrote:
> > Sorry for the delay. I thought I had sent the response to this but I
> > guess I did not hit send and then I got sick for a while.
> >
> > Hi,
> >
> > The  application/prs.ktb+zip  registration is basically sound —
> > correct  prs.  tree,  +zip  suffix, LIMITED USE, concrete change
> > controller. One fix before I can recommend it.
> >
> > Security considerations. The current wording ("contains html which
> > can
> > contain javascript but ... execution of malware is impossible") isn't
> > actionable. Since the HTML comes from an untrusted file, please
> > phrase
> > it as consumer obligations. Something like:
> >
> > • Consumers MUST treat the HTML as untrusted and MUST NOT execute
> > embedded active content (scripts, event handlers, auto-loaded
> > external
> > resources), regardless of file contents.
> > • Consumers SHOULD sanitize the HTML to the expected Qt HTML-4 subset
> > before rendering.
> > • As a ZIP, implementations MUST guard against decompression bombs
> > (bound uncompressed size) and path traversal (reject absolute paths
> > and  .. ).
> >
> > With that revised, I'm happy to recommend registration.
> >
> > Thanks,
> > Darrel
> >
> >
> > ________________________________________
> > From: Amanda Baber via RT <[e-mail]>
> > Sent: September 19, 2026 1:11 AM
> > Cc: Darrel Miller; [e-mail]
> > Subject: [IANA #1456008] application/prs.ktb+zip registration request
> >
> > Hi Darrel,
> >
> > The applicant is pinging us for this request from July 21st.
> >
> > thanks,
> > Amanda
> >
> > On Tue Aug 25 19:21:37 2026, amanda.baber wrote:
> > > Hi Darrel,
> > >
> > > Sending a reminder for this request from July 21st.
> > >
> > > Thanks,
> > > Amanda
> > >
> > > On Tue Jul 21 09:47:44 2026, amanda.baber wrote:
> > > > Hi Darrel,
> > > >
> > > > Here's an updated version of the form that includes a Windows
> > > > clipboard name field.
> > > >
> > > > thanks,
> > > > Amanda
> > > >
> > > > Name: Abdulrahman Waleed
> > > >
> > > > Email: [e-mail]
> > > >
> > > > Media type name: application
> > > >
> > > > Media subtype name: prs.ktb+zip
> > > >
> > > > Required parameters: N/A
> > > >
> > > > Optional parameters: N/A
> > > >
> > > > Encoding considerations: binary
> > > >
> > > > Security considerations:
> > > >
> > > > (1) the format contains html which can contain javascript but the
> > > > application that uses it should be a word processor and html
> > > > should
> > > > be
> > > > used only to embed text into the pages so that the execution of
> > > > malware is impossible.
> > > > (2) The format does not privacy services, it is a document file
> > > > that
> > > > if the user wants it private it is the user's responsibility to
> > > > store
> > > > it safely or encrypt it.
> > > > (3) It inherits all security considerations of JSON and ZIP
> > > > archives.
> > > > (4) The file type may contain standard HTML hyperlinks. These
> > > > links
> > > > are not structurally required to render or interpret the core
> > > > text
> > > > of
> > > > the document.
> > > >
> > > > Interoperability considerations: Interoperability is limited to
> > > > applications that implement support for this specific archive
> > > > structure.
> > > >
> > > > Software must be able of decompressing a standard ZIP and parsing
> > > > the
> > > > internal HTML content (A subset of HTML 4 https://doc.qt.io/qt-
> > > > 6/richtext-html-subset.html) and custom JSON metadata files.
> > > >
> > > > Published specification: https://github.com/abdulrahman-103/Kitab
> > > >
> > > > Applications which use this media: The "Kitab" word processor
> > > > uses
> > > > .ktb files where it is a ZIP containing an HTML file for pages
> > > > content
> > > > and a JSON file for document metadata such as page size and
> > > > margins.
> > > > https://github.com/abdulrahman-103/Kitab
> > > >
> > > > Fragment identifier considerations: Fragment identifiers are not
> > > > used
> > > > or defined for this file format.
> > > >
> > > > Restrictions on usage: There are no restrictions.
> > > >
> > > > Provisional registration? (standards tree only): No
> > > >
> > > > Additional information:
> > > >
> > > > 1. Deprecated alias names for this type: N/A
> > > > 2. Magic number(s): 50 4B 03 04
> > > > 3. File extension(s): .ktb
> > > > 4. Macintosh file type code: N/A
> > > > 5. Object Identifiers: N/A
> > > > 6. Windows clipboard name: Kitab Document
> > > > 7. MacOS Uniform Type Identifier: org.kitab.document
> > > >
> > > > Person to contact for further information:
> > > >
> > > > 1. Name: Abdulrahman Waleed
> > > > 2. Email: [e-mail]
> > > >
> > > > Intended usage: LIMITED USE
> > > >
> > > > This file format is for the Kitab word processor and it is
> > > > currently
> > > > the only app and word processor that uses this file extension.
> > > >
> > > > Author/Change controller: Abdulrahman Waleed,
> > > > [e-mail]
> > > >
> > > > On Fri Jul 17 01:11:00 2026, david.dong wrote:
> > > > > Hi Darrel,
> > > > >
> > > > > Can you review this new request for us by July 30th?
> > > > >
> > > > > Thank you.
> > > > >
> > > > > Best regards,
> > > > >
> > > > > David Dong
> > > > > IANA Services Sr. Specialist
> > > > >
> > > > > --
> > > > >
> > > > > Name: Abdulrahman Waleed
> > > > >
> > > > > Email: [e-mail]
> > > > >
> > > > > Media type name: application
> > > > >
> > > > > Media subtype name: prs.ktb+zip
> > > > >
> > > > > Required parameters: N/A
> > > > >
> > > > > Optional parameters: N/A
> > > > >
> > > > > Encoding considerations: binary
> > > > >
> > > > >
> > > > >
> > > > > Security considerations: (1) the format contains html which can
> > > > > contain javascript but the application that uses it should be a
> > > > > word
> > > > > processor and html should be used only to embed text into the
> > > > > pages
> > > > > so
> > > > > that the execution of malware is impossible.
> > > > > (2) No, the format does not privacy services, it is a document
> > > > > file
> > > > > that if the user wants it private it is the user's
> > > > > responsibility
> > > > > to
> > > > > store it safely or encrypt it.
> > > > > (3) N/A
> > > > > (4) It inherits all security considerations of JSON and ZIP
> > > > > archives.
> > > > > (5) The file type may contain standard HTML hyperlinks. These
> > > > > links
> > > > > are not structurally required to render or interpret the core
> > > > > text of
> > > > > the document.
> > > > >
> > > > > Interoperability considerations: Interoperability is limited to
> > > > > applications that implement support for this specific archive
> > > > > structure.
> > > > > Software must be able of decompressing a standard ZIP and
> > > > > parsing
> > > > > the
> > > > > internal HTML content (A subset of HTML 4 https://doc.qt.io/qt-
> > > > > 6/richtext-html-subset.html) and custom JSON metadata files.
> > > > >
> > > > > Published specification: https://github.com/abdulrahman-
> > > > > 103/Kitab
> > > > >
> > > > > Applications which use this media: The "Kitab" word processor
> > > > > uses
> > > > > .ktb files where it is a ZIP containing an HTML file for pages
> > > > > content
> > > > > and a JSON file for document metadata such as page size and
> > > > > margins.
> > > > > https://github.com/abdulrahman-103/Kitab
> > > > >
> > > > > Fragment identifier considerations: Fragment identifiers are
> > > > > not
> > > > > used
> > > > > or defined for this file format.
> > > > >
> > > > > Restrictions on usage: There are no restrictions.
> > > > >
> > > > > Provisional registration? (standards tree only): No
> > > > >
> > > > > Additional information:
> > > > >
> > > > > 1. Deprecated alias names for this type: N/A
> > > > > 2. Magic number(s): 50 4B 03 04
> > > > > 3. File extension(s): .ktb
> > > > > 4. Macintosh file type code: N/A
> > > > > 5. Object Identifiers: N/A
> > > > >
> > > > > General Comments: N/A
> > > > >
> > > > > Person to contact for further information:
> > > > >
> > > > > 1. Name: Abdulrahman Waleed
> > > > > 2. Email: [e-mail]
> > > > >
> > > > > Intended usage: LIMITED USE
> > > > >
> > > > > This file format is for the Kitab word processor and it is
> > > > > currently
> > > > > the only app and word processor that uses this file extension.
> > > > >
> > > > > Author/Change controller: Abdulrahman Waleed,
> > > > > [e-mail]