Re: Working group last call on draft-ietf-sieve-include
Aaron Stone <[email protected]>
| Newsgroups | gmane.ietf.mta-filters |
|---|---|
| Message-ID | <CAEdAYKWKDcr612FYdr8vn1z20wAQT20aTmEpEgsCes1L-RZGEw@mail.gmail.com> |
On Mon, Sep 26, 2011 at 2:06 PM, Alexey Melnikov <[email protected]> wrote: > Hi Robert, > > Robert Burrell Donkin wrote: > >> On Sat, Sep 24, 2011 at 4:08 PM, Alexey Melnikov >> <[email protected]> wrote: >>> >>> Aaron Stone wrote: >>> >> >> <snip> >> >>>> >>>> In the case of a MUST, it means that a valid includes implementation >>>> imposes a script naming restriction. If a site isn't using >>>> managesieve, would that site really need to accept the name >>>> restrictions? >>>> >>> >>> If you don't make it a MUST, then nobody can be relied upon the rule. >>> >> >> I'm a little unclear why allowing people to rely on this rule should >> be seen as good thing... >> >> 1. Can anyone think of a use case that could be satisfied best by an >> author intentionally including a restricted script name? >> > ManageSieve script names are quite permissive: basically various control > characters are disallowed. IMHO, disallowing control characters in script > names is a good thing. > >> 2. Allowing implementors to rely on this rule may create a false sense >> of security, and so may encourage them to neglect proper checks on >> names before accessing their backing store. What are the positive >> benefits that outweigh this risk? >> > Quite the opposite: if the rule is a MUST, then implementations can validate > names and reject invalid ones. > >> In any case, I think reminding people about potential attacks in "4. >> Security Considerations" would be useful, so I would like to see >> something like [1] included >> >> Robert >> >> [1] Sieve implementations MUST check that script names are safe for >> use with their storage system. Any script including a name which could >> be used as a vector to attack the system used to store scripts MUST be >> rejected. >> > > This is probably worth adding irrespectively of my comments above. Agreed, I'll include this language. I also have Stephan's list of his updates that I missed, so I'll integrate both and post an update. Cheers, Aaron _______________________________________________ sieve mailing list [email protected] https://www.ietf.org/mailman/listinfo/sieve