On Fr, 29.10.21 13:57, David Cantrell (dcantrell(a)redhat.com) wrote:
Has there been any consideration for potential security risks with
regards to the data in this string? Of concern to me are encoding
formats, size limits or reporting, and structure formats. The
proposal notes JSON, which has been involved in security related
problems in the past.
One of the reasons we are sticking to JSON here is so that we can use
battle-tested parsers we already use for other stuff. you want a
parser that is already used, verified, tested elsewhere, and JSON
makes that easy. A homegrown parser of an entirely new special purpose
format is a lot more problematic security-wise.
Lennart
--
Lennart Poettering, Berlin