Subject: [VCARDDAV] Problems with quoting parameter values

From: Mike Douglass <[email-masked]>
Date: Tue, 05 Oct 2010 12:12:06 -0400

There is a significant ambiguity in Section 5 as regards quoting. The 
following came about as a result of trying to implement generalised 
parsing for vcard. The addition of SORT-AS as a parameter raised some 
interesting issues. While trying to resolve some interoperability issues 
at the CalConnect interoperability test event, discussions with Cyrus 
Daboo led to the following suggestions,

Section 5 has the statement
    Property parameter values that contain the COLON (US-ASCII decimal
    58), SEMICOLON (US-ASCII decimal 59) or COMMA (US-ASCII decimal 44)
    character separators MUST be specified as quoted-string text values.
    Property parameter values MUST NOT contain the DQUOTE (US-ASCII
    decimal 22) character.  The DQUOTE (US-ASCII decimal 22) character is
    used as a delimiter for parameter values that contain restricted
    characters or URI text.

It's not clear what is meant by "values"

For example PID contains a COMMA in the parameter value. It's not clear 
whether "values" refers to the value as a whole or to the individual 
elements.
We also have
      sort-as-param = "SORT-AS=" sort-as-value

      sort-as-value = list-component *(";" list-component)

In addition ALTID is defined as

            altid-param = "ALTID=" text

The normative specification for "text" allows DQUOTE in the value

iCalendar (RFC5545) section 3.1 defines
      param         = param-name "=" param-value *("," param-value)
      ; Each property defines the specific ABNF for the parameters
      ; allowed on the property.  Refer to specific properties for
      ; precise parameter ABNF.

      param-name    = iana-token / x-name

      param-value   = paramtext / quoted-string

      paramtext     = *SAFE-CHAR

We suggest changing the specification as follows:

Section 3.2 should be amended such that

      any-param  = (iana-token / x-name) "=" param-value

is replaced with

      any-param  = (iana-token / x-name) "=" param-value *("," param-value)

This should allow unambiguous parsing of future extensions to vcard if 
those extensions follow the generic rules above, and specifically allows 
lists to be parsed.

Section 5 change:
    A property can have attributes associated with it.  These "property
    parameters" contain meta-information about the property or the
    property value.

    Property parameter values that contain the COLON (US-ASCII decimal
to
    A property can have attributes associated with it.  These "property
    parameters" contain meta-information about the property or the
    property value. In some cases the property parameter can be multi-valued
    in which case the property parameter value elements are separated by a
    COMMA (US-ASCII decimal 44).

    Property parameter value elements that contain the COLON (US-ASCII 
decimal

In addition the following parameter definitions need to be changed to 
follow this rule:

Section 5.5: change

            altid-param = "ALTID=" text
to
            altid-param = "ALTID=" param-value
The examples should probably contain some quoted text values

Section 5.9 SORT-AS:

      sort-as-param = "SORT-AS=" sort-as-value

      sort-as-value = param-value *("," param-value)

The examples need to be adjusted to match.

Section 5.11 TZ change
      tz-param  = "TZ=" DQUOTE (text / uri) DQUOTE
to
      tz-param  = "TZ=" param-value / DQUOTE uri DQUOTE

---

From: Simon Perreault <[email-masked]>
Date: Tue, 05 Oct 2010 12:28:42 -0400

Thank you very much for fixing this important issue! I'll apply your
changes verbatim.

Simon

On 2010-10-05 12:12, Mike Douglass wrote:
> _______________________________________________
> VCARDDAV mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/vcarddav

-- 
NAT64/DNS64 open-source --> http://ecdysis.viagenie.ca
STUN/TURN server        --> http://numb.viagenie.ca
vCard 4.0               --> http://www.vcarddav.org