Subject: [netmod] new issue Y59

From: Ladislav Lhotka <[email-masked]>
Date: Wed, 19 Nov 2014 22:45:59 +0100

Hi,

as per an action item form today's interim, I propose the following issue to
be added to the list.

Lada

PS. I committed it already to the Org source but not to HTML.

-------------------------------------------------------------------

* NEW :Y59: restrict use of 64-bit numbers in XPath expressions

** Description

   Numbers in XPath 1.0 are double-precision floating-point. 64-bit
   numeric types in YANG (uint64, int64 and decimal64) exceed the
   precision of IEEE 754 values and their use in XPath expressions
   ("must" and "when" statements) is therefore unsafe.

   Example: For the leaf definition

   #+BEGIN_EXAMPLE
   leaf foo {
     type decimal64 {
       fraction-digits 18;
     }
     must ". = 1";
   }
   #+END_EXAMPLE

   the value <foo>1.00000000000000001</foo> will successfully
   validate.

   This may lead to unexpected behavior and may be also used as an
   attack vector.

** Solution Y59-01

   Add the following text to Sec. 6.4 (before 6.4.1):

   As XPath 1.0 only supports double-precision floating-point numbers,
   values of uint64, int64 and decimal64 types (Section 9.2 and 9.3)
   cannot be exactly represented in XPath expressions. Data nodes with
   these types therefore SHOULD NOT be used in numeric comparisons or
   in numeric XPath functions.

-- 
Ladislav Lhotka, CZ.NIC Labs
PGP Key ID: E74E8C0C