Subject: Re: [Json] AD Evaluation of draft-ietf-json-text-sequence-07

From: Nico Williams <[email-masked]>
Date: Mon, 8 Dec 2014 22:36:56 -0600

On Sun, Oct 19, 2014 at 12:35:29PM -0500, Pete Resnick wrote:
> Just a nit here: it seems to me "can" is better than "should" here.
> 
>    the parser SHOULD report such failures so that applications may
>    terminate processing if desired.
> 
> That's not an appropriate use of SHOULD. Reporting errors up the
> application stack isn't part of interoperability. Instead, how
> about: "however, applications might wish to terminate processing in
> this case, so it is useful for parsers to report JSON-text parsing
> failures to the application."

It might be useful from a security point of view, since incomplete/
invalid texts could otherwise be used to smuggle data past a simple
checker that merely parses (but does not re-encode) a sequence.

Perhaps this should be worded as "SHOULD provide an option for warning
about incomplete or invalid JSON texts in the sequence"?

Nico
--