Re: [quicwg/base-drafts] QPACK security considerations (#3575)

[afrind <[e-mail]>]

@afrind commented on this pull request.



> @@ -1155,6 +1369,19 @@ to an excess of unsent data might include limiting the ability of the peer to
 open new streams, reading only from the encoder stream, or closing the
 connection.
 
+
+## Implementation Limits
+
+An implementation of QPACK needs to ensure that large values for integers, long
+encoding for integers, or long string literals do not create security
+weaknesses.
+
+An implementation has to set a limit for the values it accepts for integers, as
+well as for the encoded length (see {{prefixed-integers}}). In the same way, it
+has to set a limit to the length it accepts for string literals (see
+{{string-literals}}).

@MikeBishop : I can't quite figure an elegant way to mention the minimum here.  It is already mentioned in the referenced section.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3575#discussion_r420457616