Subject: [Json] [Technical Errata Reported] RFC7158 (3908)

From: RFC Errata System <[email-masked]>
Date: Sun, 2 Mar 2014 12:46:50 -0800 (PST)

The following errata report has been submitted for RFC7158,
"The JavaScript Object Notation (JSON) Data Interchange Format".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=7158&eid=3908

--------------------------------------
Type: Technical
Reported by: Marc Lehmann <[email-masked]>

Section: Security con

Original Text
-------------

Corrected Text
--------------

Notes
-----
This is a followup to my previous errata. I just wanted to note that this should also be discusssed in the security considerations.

Consider a protocol that would allow back-to-back json messages. For example, a banking protocol that accepted currency amounts.

A RFC7158 encoder could now encode the two separate amounts "1" and "999" and end up with the single amount "1999", which couldn't happen with the original JSON specification.

Since this affects existing protocols and could potentially result in serious misinterpretations, I think noting this in the security considerations sections would be prudent.

Instructions:
-------------
This errata is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party (IESG)
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC7158 (draft-ietf-json-rfc4627bis-10)
--------------------------------------
Title               : The JavaScript Object Notation (JSON) Data Interchange Format
Publication Date    : March 2014
Author(s)           : T. Bray, Ed.
Category            : PROPOSED STANDARD
Source              : JavaScript Object Notation
Area                : Applications
Stream              : IETF
Verifying Party     : IESG