[media-types] Re: [IANA #1458209] application/vnd.fi duswriter+zip registration request

Inline.

-MSK

On Mon, Aug 17, 2026 at 5:39 PM Amanda Baber via RT <
[email protected]> wrote:

> Name: Johannes Wilm
>
> Email: [email protected]
>
> Media type name: application
>
> Media subtype name: vnd.fiduswriter+zip
>
> Required parameters: N/A.
>
> Optional parameters: N/A.
>
> Encoding considerations: binary
>
> This media type is a ZIP container (indicated by the "+zip"
> structured syntax suffix). The archive is transferred as binary data and
> MUST NOT be encoded as text. In MIME e-mail contexts, transfer encoding
> such as base64 is required.
>

I suggest saying "binary" here is sufficient, and this prose is redundant
to what's written elsewhere, so it could be trimmed.

In any event, the MUST/SHOULD language is appropriate for the published
specification but not for the registration template.


> Security considerations: The content is a ZIP archive that contains a
> declarative JSON document
> together with images and optional template assets. The security
> considerations are therefore similar to those of other ZIP-based
> container formats (application/zip, ODF, EPUB), with the additional
> concerns of JSON processing:
>

I suggest referring to the specifications for ZIP and JSON, which are
https://www.iana.org/assignments/media-types/application/zip for the former
and RFC 8259 for the latter.


> - Archive handling: The archive may contain compressed entries.
> Implementations MUST bound the total uncompressed size and the number
> of entries to mitigate decompression-bomb ("zip bomb") attacks, and
> MUST NOT write archive entries outside a designated target directory to
> avoid path-traversal ("zip slip") vulnerabilities.
>

As above, I suggest "MUST" and "MUST NOT" become "must" and "must not".
Alternatively, just remove this if it's covered in the published
specification.


> - Entry name handling: Entry names MUST be treated as opaque identifiers
> inside the archive. Applications MUST NOT use them as filesystem paths
> without sanitisation, and MUST NOT allow absolute paths or ".."
> segments to escape the extraction directory.
>

Same.


> - JSON payloads: The archive contains JSON files (document.json,
> images.json, bibliography.json and optional template metadata).
> Implementations MUST parse them with a strict JSON parser, reject
> malformed input, and ignore unknown or unexpected fields. There is no
> scripting or executable content defined by this media type; the JSON is
> purely declarative.
>

Same.


> - Embedded resources: The archive may contain images and template assets.
> These MUST be treated as untrusted binary data. Applications should not
> execute, render with active content, or otherwise run anything contained
> in the archive.
>

Same.


> - Content-type confusion: Because the container is a generic ZIP file, a
> malicious actor could disguise unrelated ZIP content as a Fidus Writer
> document. Implementations MUST validate the "mimetype" entry and the
> "filetype-version" entry before processing the archive and MUST NOT rely
> on the filename extension alone.
>

Same.

The rest is fine.

_______________________________________________
media-types mailing list -- [email protected]
To unsubscribe send an email to [email protected]