Subject: [Geopriv] draft-ietf-geopriv-dhcp-lybr-uri-option-00 and scripts

From: Eric Rescorla <[email-masked]>
Date: Sun, 02 Mar 2008 17:48:17 -0800

I don't understand the argument made in 3.2 about URIs that may
contain scripts. 

   There are, in fact, some types of URIs that are not good to receive,
   due to security concerns.  For example, any URLs that can have 
   scripts, such as "data:" URLs, and some "HTTP:" URLs that go to web 
   pages - that have scripts.  Therefore,

   o URIs received via this Option SHOULD NOT be sent to a 
     general-browser to connect to a web page, because they could have 
     harmful scripts.

   o This Option SHOULD NOT contain "data:" URLs, because they could 
     contain harmful scripts.

   Instead of listing all the types of URIs and URLs that can be 
   misused or potentially have harmful affects, Section 3.3 IANA 
   registers acceptable Location-URI schemes (or types).

This doesn't seem to me to be a sensible security measure.

1. Browsers and other clients need to be able to handle any
   data they dereference safely, whether or not it contains
   scripts.
2. Clients can simply refuse to execute scripts.
3. This implies that there is now an invariant (and moreover implies
   an invariant in the future) that sip:, sips:, and pres:, URIs may
   never contain scripts. That seems unreasonable.  Moreover, as far
   as I know, there is no rule that forbids SIP bodies from containing
   HTML, so why can't they contain scripts?

-Ekr
_______________________________________________
Geopriv mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/geopriv

---

From: "James M. Polk" <[email-masked]>
Date: Mon, 03 Mar 2008 11:19:13 -0600

Eric

Most of section 3.2 came from a discussion with Lisa D.  I'm quite 
open to help with this section, or with the movement or rewrite of 
any or all of this into the security considerations section.

I fully acknowledge this section is the weakest of the ID.

James