-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
In message <[email protected]>, Timo
Gerke <[email protected]> writes
>Leaving the JSON structure completely open and unguided directly
>inside the RFC 5322 MIME headers
What are you actually talking about here ??
The only JSON in DKIM2 occurs in the DKIM2-Signature header fields. This
is not "inside" any MIME headers (and RFC5322 is not the place to look
for definitions of MIME headers anyway).
Also the JSON structure is not "completely open". The schema provided in
the specification ties down as much as possible (ie as much as the
schema language permits) -- if we have missed any meta-description that
can be applied within the schema (where standard libraries can check it)
then we would pleased to add more. We had to put a number of the
restrictions into the text description and there we rely on people (and
Claude) coding it correctly.
>Without strict boundaries, it forces edge
>infrastructure to run complex object parsers on untrusted
>payloads before filtering, opening up unwanted vectors for parser
>differentials and recursion.
If your JSON library cannot cope with untrusted input then you are in a
world of pain long before you get to considering email.
>Enforcing a strictly flat tag-value representation or a
>hard nesting limit (like d=1 or d=2) within the specification
>would immediately solve the parsing risks while keeping the
>transition as smooth as possible.
please supply text
- --
richard @ highwayman . com "Nothing seems the same
Still you never see the change from day to day
And no-one notices the customs slip away"
-----BEGIN PGP SIGNATURE-----
Version: PGPsdk version 1.7.1
iQA/AwUBap13YGHfC/FfW545EQK2TwCgyF1+n+ykA7NgQunajxVqDBdgDtoAoJc4
4SZUKIUXs/7iSxULO2KRphjA
=zcN0
-----END PGP SIGNATURE-----
_______________________________________________
Ietf-dkim mailing list -- [email protected]
To unsubscribe send an email to [email protected]
