Subject: [Xml-sg-cmt] Possible change to submission policy/practices

From: Robert Sparks <[email-masked]>
Date: Fri, 4 Feb 2022 10:20:02 -0600

All -

This is a heads-up message - I don't think this forum is the deciding 
group, but I wanted your input early. I'll be taking this to the IESG 
soon (possibly as part of next week's tools call).

We currently allow drafts into the repository that have XML includes and 
algorithmic includes (v2 era ?rfc include="https:....) in them.

The security review of the datatracker highlighted the dangers with 
allowing arbitrary includes, and xml2rfc's default behavior has been 
limited by the last few releases to mitigate them.

But looking closer at this, I have to note that we have an issue with 
accepting drafts that rely on this external content as that content may 
change. I think we may even still have this issue with drafts entering 
the RFC Editor queue.

I am going to propose that we change the submit tool to only allow 
self-contained internet-drafts. All references must be expanded already. 
Authors can still keep the pronoun references to "the current version" 
in their source, but that source must go through a prep-like step before 
submission completes.

I am also going to propose that our online services won't prep arbitrary 
urls, but will move to tokens (like the v2 include="draft-foo-bar") that 
the services know how to expand.

Thoughts?

RjS

---

From: "John R Levine" <[email-masked]>
Date: 4 Feb 2022 17:18:37 -0500

> algorithmic includes (v2 era ?rfc include="https:....) in them.

Wow, what a bad idea.

> Authors can still keep the pronoun references to "the current version" in 
> their source, but that source must go through a prep-like step before 
> submission completes.
>
> urls, but will move to tokens (like the v2 include="draft-foo-bar") that the 
> services know how to expand.

Seems reasonable but I wonder if there are people running random stuff 
that is not yet an I-D through the xml2rfc server because they won't or 
can't install it locally.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly