IETF Logo Mail Archive

Re: [secdir] Secdir last call review of draft-ietf-jsonpath-iregexp-06

Tim Bray <tbray@textuality.com> Mon, 15 May 2023 15:52 UTC

Return-Path: <tbray@textuality.com>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9FF1CC16950A for <secdir@ietfa.amsl.com>; Mon, 15 May 2023 08:52:20 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.096
X-Spam-Level:
X-Spam-Status: No, score=-2.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=textuality.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ngleJifRzxoL for <secdir@ietfa.amsl.com>; Mon, 15 May 2023 08:52:16 -0700 (PDT)
Received: from mail-ed1-x534.google.com (mail-ed1-x534.google.com [IPv6:2a00:1450:4864:20::534]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9ADFEC169534 for <secdir@ietf.org>; Mon, 15 May 2023 08:52:16 -0700 (PDT)
Received: by mail-ed1-x534.google.com with SMTP id 4fb4d7f45d1cf-50bc22805d3so19617402a12.1 for <secdir@ietf.org>; Mon, 15 May 2023 08:52:16 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=textuality.com; s=google; t=1684165934; x=1686757934; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=Ty5f6xzcgMPTNY/hnq1QMMIm+SNwcD790v+2TukSxwE=; b=V0/AQncVeMQG3EADsz4Ej32T0HZK/110eyIk0iY0UuIZ7lUCAyL8j7dCKvE8RmWBka b+bmxJX3K0xSUYAhOMGdRRE/C2DqiaUzEanatcWM1Z3ylBt78Bhob2GkPkneuU/oyM+M N9kSnJErVCz/+3nsuB7mW8cd/vTAHO1kf9AQc=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1684165934; x=1686757934; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=Ty5f6xzcgMPTNY/hnq1QMMIm+SNwcD790v+2TukSxwE=; b=GOiqa65rv8ri7trL1zQ+yguuJfl7SvllK6bWd97oZ7WDsYsFTCEtIsil8YQyeu300V 6u9faXY2em6719CWeJ5Kkz1WrJQ8KGoEXpQCngnGivtoStZgNJaQNoK85zf7cw03ZhmG h8IYcPj2amB37dtChWoTX5/ku/D+QesvRTiBJHrwr6CL6yZBNOSsN4DekLuLMpPs/J4S /Yk/zugSYNmLR3SWyPQoig9wsS5S2DNt1Y56fGdYt2E5znJiqZClqR7V1nb0bqvYb7jc UEbU3mpFnpQvS/5fAw9dMzMzd25lOa3uVvGLhOXzFUoCvnfrTgqKTC4WWhvdFVhMyK2e 7zRw==
X-Gm-Message-State: AC+VfDx3rqykrr9PCN6V7cVvdYoNQNQkiJ6XHT+06+mt1nTQOSByL9Vs oG1756OU63GmtagEpZVFHJTf2dmIk1qbQdLt25oGow==
X-Google-Smtp-Source: ACHHUZ4knWHRKrg7EMsEsB15vCbYfEnxUtuzFXARkpSXTQNSS+f4+yqt6p4wuyzrBFTYS48tUu/wrmtx4NAexjIT968=
X-Received: by 2002:a05:6402:1a43:b0:50b:d0a1:f737 with SMTP id bf3-20020a0564021a4300b0050bd0a1f737mr24755866edb.7.1684165933972; Mon, 15 May 2023 08:52:13 -0700 (PDT)
MIME-Version: 1.0
References: <168416383998.50512.953102690552943438@ietfa.amsl.com>
In-Reply-To: <168416383998.50512.953102690552943438@ietfa.amsl.com>
From: Tim Bray <tbray@textuality.com>
Date: Mon, 15 May 2023 08:52:03 -0700
Message-ID: <CAHBU6iuKKp3g_HbhgaZT8CcStQBKoaHOcdf9ogku=bftYt5wgA@mail.gmail.com>
To: Mike Ounsworth <mike.ounsworth@entrust.com>
Cc: secdir@ietf.org, draft-ietf-jsonpath-iregexp.all@ietf.org, jsonpath@ietf.org, last-call@ietf.org
Content-Type: multipart/alternative; boundary="0000000000003cd8b605fbbd70d9"
Archived-At: <https://mailarchive.ietf.org/arch/msg/secdir/LPITzVFJ2Ho9uJf2hNHnMyACTIY>
Subject: Re: [secdir] Secdir last call review of draft-ietf-jsonpath-iregexp-06
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 15 May 2023 15:52:20 -0000

I was reading your note and agreeing that yes, it remains possible to
devise regexps that are going to cause combinatorial nasties in almost any
conceivable implementation, but unconvinced about the conclusion that it is
"still not advisable to run arbitrary user-provided regular expressions on
your hardware", because it seems to me that the only way to find out if the
regexp is evil is to run it.

But I think your closing paragraph provides a solution.

On Mon, May 15, 2023 at 8:17 AM Mike Ounsworth via Datatracker <
noreply@ietf.org> wrote:
…

>  I wonder if this
> document could recommend that implementations include some sort of
> configurable
> limit on nesting level or on recursion / backtracking depth.


That sounds like a good direction, but pretty complex. A simpler option
would be that implementations impose a limit on time and/or memory costs
and error out when those are breached. Do you think that a recommendation
along those lines would address your concerns?

v2.23.0 | Report a Bug | By Email