From 7a25d4f4ed3b17dcd814de53eada3ed7d72c59ca Mon Sep 17 00:00:00 2001 From: Henry Andrews Date: Mon, 13 Nov 2017 16:08:47 -0800 Subject: [PATCH 1/6] Add CREF for "self" link sub-path Since I have no idea what it is trying to do. --- jsonschema-hyperschema.xml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/jsonschema-hyperschema.xml b/jsonschema-hyperschema.xml index 44fdee29..afea79e6 100644 --- a/jsonschema-hyperschema.xml +++ b/jsonschema-hyperschema.xml @@ -2382,7 +2382,10 @@ Link: rev=up
- Need to reference the core and validation security considerations. + + JSON Hyper-Schema defines a vocabulary for JSON Schema core and concerns all + the security considerations listed there. +
When link relation of "self" is used to denote a full representation of an @@ -2391,6 +2394,11 @@ Link: rev=up the target URI is not equivalent to or a sub-path of the URI used to request the resource representation which contains the target URI with the "self" link. + + It is no longer clear what was intended by the "sub-path" option in + this paragraph. While paths are defined as a hierarchical system + by RFC 3986, there semantics of the hierarchy are not defined. +
From 489dd5efc65b47262ca65023e1ac9dea35890344 Mon Sep 17 00:00:00 2001 From: Henry Andrews Date: Mon, 13 Nov 2017 16:26:23 -0800 Subject: [PATCH 2/6] Clean up target attribute security considerations This was an awkward copy-paste. Fix it up and remove the CREF reminding me to do so. --- jsonschema-hyperschema.xml | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/jsonschema-hyperschema.xml b/jsonschema-hyperschema.xml index afea79e6..b0d02a31 100644 --- a/jsonschema-hyperschema.xml +++ b/jsonschema-hyperschema.xml @@ -563,7 +563,7 @@
-
+
All properties in this section are advisory only. While keywords such as "title" and "description" are used primarily to present the link @@ -2403,15 +2403,15 @@ Link: rev=up
- - This whole section needs more work, but I do like having security - concerns around target interactions consolidated and addressed as a whole. - + As stated in , all LDO keywords describing + the target resource are advisory and MUST NOT be used in place of + the authoritative information supplied by the target resource in response + to an operation. - The "targetMediaType" property in link definitions defines the expected - format of the link's target. - However, this is advisory only, and MUST NOT be considered authoritative. + Clients MUST NOT use the value of "targetSchema" to aid in the interpretation + of the data received in response to following the link, as this leaves + "safe" data open to re-interpretation. When choosing how to interpret data, the type information provided by the @@ -2429,11 +2429,14 @@ Link: rev=up precautions for "targetSchema". - The "targetSchema" keyword has similar security concerns to that of - "targetMediaType". - Clients MUST NOT use the value of this property to aid in the interpretation - of the data received in response to following the link, as this leaves - "safe" data open to re-interpretation. + Protocol meta-data values conveyed in "targetHints" MUST NOT be considered + authoritative. Any security considerations defined by the protocol that + may apply based on incorrect assumptions about meta-data values apply. + + + Even when no protocol security considerations are directly applicable, + implementations MUST be prepared to handle responses that do not + match the link's "targetHints" values.
From 8a27a0c64b07de9bfe10114828be007cdd3f15b6 Mon Sep 17 00:00:00 2001 From: Henry Andrews Date: Mon, 13 Nov 2017 22:03:19 -0800 Subject: [PATCH 3/6] Reference RFC 8288 in Security Considerations 8288 is the update of 5988 Web Linking. As a link serialization format, Hyper-Schema shares those vulnerabilities. --- jsonschema-hyperschema.xml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jsonschema-hyperschema.xml b/jsonschema-hyperschema.xml index b0d02a31..a44fed58 100644 --- a/jsonschema-hyperschema.xml +++ b/jsonschema-hyperschema.xml @@ -2384,7 +2384,10 @@ Link: rev=up
JSON Hyper-Schema defines a vocabulary for JSON Schema core and concerns all - the security considerations listed there. + the security considerations listed there. As a link serialization format, + the security considerations of RFC 8288 Web Linking + also apply, with appropriate adjustments (e.g. "anchor" as an LDO keyword rather + than an HTTP Link header attribute).
From c0373a3f7109afab3b58e1e8810d4cb90f9db9c2 Mon Sep 17 00:00:00 2001 From: Henry Andrews Date: Mon, 13 Nov 2017 22:06:33 -0800 Subject: [PATCH 4/6] Move "self" link security bit to last subsection The other parts flow much more naturally from the mention of RFC 8288 in the introductory part of the security section. --- jsonschema-hyperschema.xml | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/jsonschema-hyperschema.xml b/jsonschema-hyperschema.xml index a44fed58..59d6966d 100644 --- a/jsonschema-hyperschema.xml +++ b/jsonschema-hyperschema.xml @@ -2389,21 +2389,6 @@ Link: rev=up also apply, with appropriate adjustments (e.g. "anchor" as an LDO keyword rather than an HTTP Link header attribute). -
- - When link relation of "self" is used to denote a full representation of an - object, the user agent SHOULD NOT consider the representation to be the - authoritative representation of the resource denoted by the target URI if - the target URI is not equivalent to or a sub-path of the URI used to request - the resource representation which contains the target URI with the "self" - link. - - It is no longer clear what was intended by the "sub-path" option in - this paragraph. While paths are defined as a hierarchical system - by RFC 3986, there semantics of the hierarchy are not defined. - - -
As stated in , all LDO keywords describing @@ -2442,6 +2427,21 @@ Link: rev=up match the link's "targetHints" values.
+
+ + When link relation of "self" is used to denote a full representation of an + object, the user agent SHOULD NOT consider the representation to be the + authoritative representation of the resource denoted by the target URI if + the target URI is not equivalent to or a sub-path of the URI used to request + the resource representation which contains the target URI with the "self" + link. + + It is no longer clear what was intended by the "sub-path" option in + this paragraph. While paths are defined as a hierarchical system + by RFC 3986, there semantics of the hierarchy are not defined. + + +