Hi!
On 9/23/26 21:06, Timo Gerke wrote:
I never said that JSON or REST APIs should be forbidden. I just
think, that global email transfer are the wrong use case for
them.
Sorry for imprecise language. I meant: I don't think OWASP recommends
against JSON use - not anyway, and especially not because using JSON on
the network incurs the risks you quoted in your earlier post.
So apparently OWASP in general sees it as possible to use JSON in ways
compliant to those recommendations (as long as other applicable
recommendations like input validation, unrestricted resource
consumption... are followed).
I'm not sure what distinguishes email from other protocols over the
public network.
Issues like arbitrarily deep nesting are something JSON has in common
with other techniques that are used by the IETF in various places like
MIME, XML, ASN.1.
It's not the task of the OWASP to forbid anything, but it is the
task of the IETF to define secure protocols.
I don't see a contradiction. You _state_ that specifying JSON makes the
protocol inherently insecure (or poses much higher risks to
implementations than they have anyway).
I'm not convinced.
What I _am_ convinced of is my suggestion for the spec to forbid
additional elements in the JSON in _all_ places (including top-level).
What I'd also be more than ok with would be adding prose to Security
Considerations that if one uses a generic JSON parser, that needs to
fulfill the security requirements like in other settings where JSON is
used in contact to potentially hostile adversaries. Parsing depth
(CPU/memory) limiting, for example.
Hannah.
--
Hannah Stern
Software Developer
Mail Transfer Development
1&1 Mail & Media Development & Technology GmbH | | |
Phone: +49 721 91374-4519
E-Mail: [email protected] | Web: www.mail-and-media.com www.gmx.net
www.web.de www.mail.com www.united-internet-media.de
Hauptsitz Montabaur, Amtsgericht Montabaur, HRB 5452
Geschäftsführer: Alexander Charles, Dr. Michael Hagenau, Thomas Ludwig, Dr.
Verena Patzelt
Member of United Internet
Diese E-Mail kann vertrauliche und/oder gesetzlich geschützte Informationen
enthalten. Wenn Sie nicht der bestimmungsgemäße Adressat sind oder diese E-Mail
irrtümlich erhalten haben, unterrichten Sie bitte den Absender und vernichten
Sie diese E-Mail. Anderen als dem bestimmungsgemäßen Adressaten ist untersagt,
diese E-Mail zu speichern, weiterzuleiten oder ihren Inhalt auf welche Weise
auch immer zu verwenden.
This e-mail may contain confidential and/or privileged information. If you are
not the intended recipient of this e-mail, you are hereby notified that saving,
distribution or use of the content of this e-mail in any way is prohibited. If
you have received this e-mail in error, please notify the sender and delete the
e-mail.
_______________________________________________
Ietf-dkim mailing list -- [email protected]
To unsubscribe send an email to [email protected]
