Subject: [scim] New I-JSON draft

From: Phil Hunt <[email-masked]>
Date: Wed, 17 Sep 2014 10:50:17 -0700

I wanted to bring to your attention the new I-JSON draft from Tim Bray. This is now going through final IETF approval.
https://datatracker.ietf.org/doc/draft-ietf-json-i-json/

Much of the requirements in this draft are already covered in our specs. 

However one major new issue that comes out of the i-JSON draft is to reject repeated objects. At the least, this is probably a security consideration.

A big problem with current parsers appears to be inconsistent handling of repeated objects. Some aggregate, some pick a random instance. This leads to security problems since you don’t know what you are getting for sure in the final parsed set of values.

Looking at Tim’s comments to the JOSE group, he indicates adoption of i-json will be an important way to pressure the common libraries and development tools to fix the issue as soon as possible.

Because we’ve already covered most of the issues, it seems like it may result in a lot of editorial changes to adopt. I’m loathe to reference yet another specification in our specification, yet it may not be avoidable. 

Does anyone have any experience with JSON parsers on this point?

Phil

@independentid
www.independentid.com
[email-masked]

---

From: Grahame Grieve <[email-masked]>
Date: Sun, 21 Sep 2014 00:00:02 +1000

my experience is that various JSON parsers behave differently when
property names are duplicated. However what Tim's draft recommends
works with all the parsers that I know of.

If SCIM has duplicate property names anywhere, I haven't found it

Grahame

On Thu, Sep 18, 2014 at 3:50 AM, Phil Hunt <[email-masked]> wrote:
> I wanted to bring to your attention the new I-JSON draft from Tim Bray. This
> is now going through final IETF approval.
> However one major new issue that comes out of the i-JSON draft is to reject
> repeated objects. At the least, this is probably a security consideration.
>
> A big problem with current parsers appears to be inconsistent handling of
> repeated objects. Some aggregate, some pick a random instance. This leads to
> security problems since you don’t know what you are getting for sure in the
> final parsed set of values.
>
> Looking at Tim’s comments to the JOSE group, he indicates adoption of i-json
> will be an important way to pressure the common libraries and development
> tools to fix the issue as soon as possible.
>
> Because we’ve already covered most of the issues, it seems like it may
> result in a lot of editorial changes to adopt. I’m loathe to reference yet
> another specification in our specification, yet it may not be avoidable.
>
> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim
>

-- 
-----
http://www.healthintersections.com.au /
[email-masked] / +61 411 867 065