Subject: Re: [quicwg/base-drafts] QPACK security considerations (#3575)

From: afrind <[email-masked]>
Date: Tue, 05 May 2020 15:42:44 -0700

@afrind pushed 1 commit.

090e72253f2285fb616c497e3e054af67769b1cf  Apply suggestions from code review

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3575/files/4c3256a0f07e838ae04aa16d2105f4f82869d0da..090e72253f2285fb616c497e3e054af67769b1cf

---

From: afrind <[email-masked]>
Date: Tue, 05 May 2020 15:50:57 -0700

@afrind pushed 1 commit.

753a49d8af28ca967dd5fe245032089f0199fff0  Wordsmithing suggestion from Bence

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3575/files/090e72253f2285fb616c497e3e054af67769b1cf..753a49d8af28ca967dd5fe245032089f0199fff0

---

From: afrind <[email-masked]>
Date: Tue, 05 May 2020 16:02:47 -0700

@afrind commented on this pull request.

> @@ -1155,6 +1369,19 @@ to an excess of unsent data might include limiting the ability of the peer to
 open new streams, reading only from the encoder stream, or closing the
 connection.
 
+
+## Implementation Limits
+
+An implementation of QPACK needs to ensure that large values for integers, long
+encoding for integers, or long string literals do not create security
+weaknesses.
+
+An implementation has to set a limit for the values it accepts for integers, as
+well as for the encoded length (see {{prefixed-integers}}). In the same way, it
+has to set a limit to the length it accepts for string literals (see
+{{string-literals}}).

@MikeBishop : I can't quite figure an elegant way to mention the minimum here.  It is already mentioned in the referenced section.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3575#discussion_r420457616

---

From: afrind <[email-masked]>
Date: Wed, 06 May 2020 13:18:42 -0700

Merged #3575 into master.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3575#event-3310135397