Subject: [scim] photo MUST be an url to an image

From: David Moebius <[email-masked]>
Date: Wed, 29 Jan 2014 10:19:56 +0100

Hi,

in http://tools.ietf.org/html/draft-ietf-scim-core-schema-02#section-6.2(photos)
you write the String given MUST be an image e.g. a GIF, JPEG, or
PNG image file.
I would say it is dangerous only to allow these 3 file types. First of all
a lot of other fileformats exist and it could be that tomorrow a great new
file format is invented that everyone would like to use.

Because of this I don't want to force the client to provide a String that
ends with e.g. .jpg

My problem is how I should be sure that the String given really points to
an image. I also don't want to call the provided address and retrieve the
image.

For this I would like to allow every String as "picture" and the client
itsself has to care about if it is a picture or not.

What do you think about this?

David

---

From: Leif Johansson <[email-masked]>
Date: Wed, 29 Jan 2014 13:42:40 +0100

> Hi,
Not being the author but...
>
> in http://tools.ietf.org/html/draft-ietf-scim-core-schema-02#section-6.2
> (photos) you write the String given MUST be an image e.g. a GIF, JPEG,
> or PNG image file.
> I would say it is dangerous only to allow these 3 file types. First of
> all a lot of other fileformats exist and it could be that tomorrow a
> great new file format is invented that everyone would like to use.
>
it sais 'e.g.' because those are example formats, not a complete list.
> Because of this I don't want to force the client to provide a String
> that ends with e.g. .jpg
>
> My problem is how I should be sure that the String given really points
> to an image. I also don't want to call the provided address and
> retrieve the image.
you can't unless you deref the URL and then content-type is your friend
>
> For this I would like to allow every String as "picture" and the
> client itsself has to care about if it is a picture or not.
we want valid URLs, not every type of string. This also includes things
like RFC 2397 (data:image)...
> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim

---

From: David Moebius <[email-masked]>
Date: Thu, 30 Jan 2014 15:01:18 +0100

Hi,

thanks for your validation of my thoughts.
Than we will check if the given String can be a URL but nothing else.

David

2014-01-29 Leif Johansson <[email-masked]>:

>  in http://tools.ietf.org/html/draft-ietf-scim-core-schema-02#section-6.2(photos) you write the String given MUST be an image e.g. a GIF, JPEG, or
> PNG image file.
> to an image. I also don't want to call the provided address and retrieve
> the image.
>
> scim mailing [email-masked]://www.ietf.org/mailman/listinfo/scim
>
>
>

---

From: Phil Hunt <[email-masked]>
Date: Thu, 30 Jan 2014 08:53:48 -0800

You could use HTTP HEAD to check that the URL is valid. Of course that can still cost if you have to process a lot of photos. But at least it avoids retrieving the actual file. 

Phil

> On Jan 30, 2014, at 6:01, David Moebius <[email-masked]> wrote:
> 
> Hi, 
> 
> 
>>> in http://tools.ietf.org/html/draft-ietf-scim-core-schema-02#section-6.2 (photos) you write the String given MUST be an image e.g. a GIF, JPEG, or PNG image file.
>>> I would say it is dangerous only to allow these 3 file types. First of all a lot of other fileformats exist and it           could be that tomorrow a great new file format is invented that everyone would like to use.
>>> Because of this I don't want to force the client to provide           a String that ends with e.g. .jpg
>>> 
>>> My problem is how I should be sure that the String given           really points to an image. I also don't want to call the provided address and retrieve the image.
>>> For this I would like to allow every String as "picture" and the client itsself has to care about if it is a picture or not.
>> we want valid URLs, not every type of string. This also includes things like RFC 2397 (data:image)...
>>>