Hi Carsten,
Thank you for your reply. Comments are in line.
On 15. Oct 2023, at 18:10, Denis wrote:
Hi Brian and Orie,
In the "old days", such problem did not existed. The prime example is using
ASN.1 / DER where the decoder can first know the full size of the message
using two or more byte
I think David's reply nailed what the WG should do:
1. recommend minimizing the code associated with parsing untrusted data.
(like https://www.w3.org/TR/webauthn-3/#clientdatajson-serialization )
2. recommend verifying data before parsing it whenever possible.
The rest is just context that was pr