Security considerations for "content*"

a.k.a. don't take executable content types from strangers

Author: handrews

jsonschema-validation.xml

@@ -9,6 +9,7 @@
 <!ENTITY RFC3986 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3986.xml">
 <!ENTITY RFC3987 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3987.xml">
 <!ENTITY RFC4291 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4291.xml">
+<!ENTITY RFC4329 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4329.xml">
 <!ENTITY RFC5322 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5322.xml">
 <!ENTITY RFC5890 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5890.xml">
 <!ENTITY RFC5891 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5891.xml">
@@ -1351,6 +1352,20 @@
                 (with so-called "catastrophic backtracking"), resulting in a denial-of-service
                 attack.
             </t>
+            <t>
+                Implementations that support validating or otherwise evaluating instance
+                string data based on "contentEncoding" and/or "contentMediaType" are at
+                risk of evaluating data in an unsafe way based on misleading information.
+                Applications can mitigate this risk by only performing such processing
+                when a relationship between the schema and instance is established
+                (e.g., they share the same authority).
+            </t>
+            <t>
+                Processing a media type or encoding is subject to the security considerations
+                of that media type or encoding.  For example, the security considerations
+                of <xref target="RFC4329">RFC 4329 Scripting Media Types</xref> apply when
+                processing JavaScript or ECMAScript encoded within a JSON string.
+            </t>
         </section>
 
         <!--
@@ -1385,6 +1400,7 @@
             &RFC3986;
             &RFC3987;
             &RFC4291;
+            &RFC4329;
             &RFC5890;
             &RFC5891;
             &RFC6570;