Hi!
On 9/7/26 00:38, Bron Gondwana wrote:
On Mon, Sep 7, 2026, at 06:23, Timo Gerke wrote:
[...]
You keep stating this like it's a fact, despite having never addressed
my response "there are people who run planet-scale email systems in
this discussion, and they are not concerned about this".
+1 to "not concerned about this" here.
- Deterministic Guardrails: To resolve these constraints, the
specification should structurally enforce a strictly flat
representation (hard nesting limit of d=1 or d=2). This
ensures sequential, stream-oriented processing with a constant
memory footprint per connection.
Have you read the schema? There is actually a nesting limit on the
JSON in Message-Instance headers. [...]
You'll notice that the deepest is that "h" tag. The depth is
OUTER-HASH => "h" => header-field-name => ARRAYOF => HASH "d": ARRAY.
That's more than 2, but it's bounded. Nothing is deeper than this.
To be fair, a naive implementation will use a _generic_ JSON parser and
only then parse out the specific recipe JSON syntax.
However, JSON parsers are allowed to have nesting depth limits (RFC 8259
Section 9). Together with setting an operational size limit on input,
this clearly limits parser effort anyway.
If someone uses an inefficient JSON parser that also doesn't allow to
impose a nesting limit, that's their responsibility and rather an
implementation detail. At most that could be a point for Security
Considerations in our draft, something like "a verifier that first
parses JSON generically without a reasonable nesting limit may be
subject to resource exhaustion attacks with invalid recipe input; make
sure to use an efficient parser and to limit input size/nesting reasonably".
[...]
Hannah.
--
Hannah Stern
Software Developer
Mail Transfer Development
1&1 Mail & Media Development & Technology GmbH | | |
Phone: +49 721 91374-4519
E-Mail:[email protected] | Web:www.mail-and-media.com www.gmx.net www.web.de www.mail.com www.united-internet-media.de
Hauptsitz Montabaur, Amtsgericht Montabaur, HRB 5452
Geschäftsführer: Alexander Charles, Dr. Michael Hagenau, Thomas Ludwig, Dr.
Verena Patzelt
Member of United Internet
Diese E-Mail kann vertrauliche und/oder gesetzlich geschützte Informationen
enthalten. Wenn Sie nicht der bestimmungsgemäße Adressat sind oder diese E-Mail
irrtümlich erhalten haben, unterrichten Sie bitte den Absender und vernichten
Sie diese E-Mail. Anderen als dem bestimmungsgemäßen Adressaten ist untersagt,
diese E-Mail zu speichern, weiterzuleiten oder ihren Inhalt auf welche Weise
auch immer zu verwenden.
This e-mail may contain confidential and/or privileged information. If you are
not the intended recipient of this e-mail, you are hereby notified that saving,
distribution or use of the content of this e-mail in any way is prohibited. If
you have received this e-mail in error, please notify the sender and delete the
e-mail.
_______________________________________________
Ietf-dkim mailing list -- [email protected]
To unsubscribe send an email to [email protected]
