Subject: Re: Issue 194: restricting allowed characters in quoted-pair

From: Mark Nottingham <[email-masked]>
Date: Tue, 6 Oct 2009 15:13:49 +1100

Closing.

On 28/09/2009, at 4:24 PM, Julian Reschke wrote:

> Roy T. Fielding wrote:
> ...
>> remove "only"
>>>     quoted-pair    = "\" ( WSP / VCHAR / obs-text )
>>>
>>>   Producers SHOULD NOT escape characters that do not require  
>>> escaping
>>>   (DQUOTE and the backslash character).
>> that should be "(i.e., other than DQUOTE and backslash)".
>> Same fix applies to the comment section.
>> ...
>
> Thanks! Applied in <http://trac.tools.ietf.org/wg/httpbis/trac/changeset/703 
> >.
>
> BR, Julian
>

--
Mark Nottingham     http://www.mnot.net/

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 6 Oct 2009 15:42:42 +1100

Now that we've dealt with allowed characters in quoted pairs <http://trac.tools.ietf.org/wg/httpbis/trac/ticket/194 
 >, can we wrap this one up too? Julian, does your proposal need to be  
modified?

<http://trac.tools.ietf.org/wg/httpbis/trac/ticket/173>

On 28/08/2009, at 9:28 AM, Henrik Nordstrom wrote:

> tor 2009-08-27 klockan 14:03 +0200 skrev Julian Reschke:
>
>> It appears that we *do* have consensus for disallowing controls in
>> quoted-pairs, thus for:
>>
> Yes.
>> However, if that's all that we do we won't have addresses issue #173
>> after all.
>
> Indeed.
>
>> Proposal:
>>
>> - add a new issue for disallowing CTLs in quoted-pair
>
> Yes.
>
>> - address #173 by tuning the definition of chunk-ext-val
>
> Which means defining a new variant of quoted-string which do not allow
> for folding for use in chunk-ext-val.
>
>    chunk-ext-val    = token / quoted-string-nf
>    quoted-string-nf = DQUOTE *( qdtext-nf / quoted-pair ) DQUOTE
>    qdtext-nf        = WSP / %x21 / %x23-5B / %x5D-7E / obs-text
>                     ; WSP / <VCHAR except DQUOTE and "\"> / obs-text
>
>
> assuming quoted-pair is fixed as discussed.
>
> Perhaps is should also be noted in text that folding is explicitly  
> forbidden in chunk headers.
>
> Comments are thankfully not allowed in chunk extensions from what I  
> can tell.
>
> Regards
> Henrik
>
>

---

From: Julian Reschke <[email-masked]>
Date: Wed, 07 Oct 2009 16:57:59 +0200

Mark Nottingham wrote:
> Now that we've dealt with allowed characters in quoted pairs 
> <http://trac.tools.ietf.org/wg/httpbis/trac/ticket/194>, can we wrap 
> this one up too? Julian, does your proposal need to be modified?
> 

Yes, that proposal doesn't help. We have addressed CTLs in qdtext with 
issue 194, but, as Henrik pointed out, we can't change quoted-string to 
disallow OWS (which is what was proposed, applied, and backed out again).

Thus, we'll have to restrict the change to <chunk-ext-val>, as proposed 
by Henrik in 
<http://lists.w3.org/Archives/Public/ietf-http-wg/2009JulSep/0621.html>:

> Perhaps is should also be noted in text that folding is explicitly forbidden in chunk headers.
> 
> Comments are thankfully not allowed in chunk extensions from what I can tell.

Ok, I applied <http://trac.tools.ietf.org/wg/httpbis/trac/changeset/707>.

The next text is almost as suggested by Henrik:

      chunk          = chunk-size *WSP [ chunk-ext ] CRLF
                       chunk-data CRLF
      chunk-size     = 1*HEXDIG
      last-chunk     = 1*("0") *WSP [ chunk-ext ] CRLF

      chunk-ext      = *( ";" *WSP chunk-ext-name
                          [ "=" chunk-ext-val ] *WSP )
      chunk-ext-name = token
      chunk-ext-val  = token / quoted-str-nf
      chunk-data     = 1*OCTET ; a sequence of chunk-size octets
      trailer-part   = *( entity-header CRLF )

      quoted-str-nf  = DQUOTE *( qdtext-nf / quoted-pair ) DQUOTE
                     ; like quoted-string, but disallowing line folding
      qdtext-nf      = WSP / %x21 / %x23-5B / %x5D-7E / obs-text
                     ; WSP / <VCHAR except DQUOTE and "\"> / obs-text

(I renamed quoted-string-nf to quoted-str-nf for compactness, and added 
an ABNF comment pointing out the difference compared to quoted-string).

Also, in the changes section I added the second sentence in:

    Clarification that the chunk length does not include the count of the
    octets in the chunk header and trailer.  Furthermore disallowed line
    folding in chunk extensions.  (Section 6.2.1)

BR, Julian

---

From: Mark Nottingham <[email-masked]>
Date: Wed, 14 Oct 2009 16:14:07 +1100

Closing issue.

On 08/10/2009, at 1:57 AM, Julian Reschke wrote:

>> >, can we wrap this one up too? Julian, does your proposal need to  
>> be modified?
> Yes, that proposal doesn't help. We have addressed CTLs in qdtext  
> with issue 194, but, as Henrik pointed out, we can't change quoted- 
> string to disallow OWS (which is what was proposed, applied, and  
> backed out again).
>
> Thus, we'll have to restrict the change to <chunk-ext-val>, as  
> proposed by Henrik in <http://lists.w3.org/Archives/Public/ietf-http-wg/2009JulSep/0621.html 
> >:
>
>>                     ; WSP / <VCHAR except DQUOTE and "\"> / obs- 
>> text assuming quoted-pair is fixed as discussed.
> Ok, I applied <http://trac.tools.ietf.org/wg/httpbis/trac/changeset/707 
> >.
>
> (I renamed quoted-string-nf to quoted-str-nf for compactness, and  
> added an ABNF comment pointing out the difference compared to quoted- 
> string).
>