On Fri, Oct 29, 2021 at 09:53:25PM +0200, Lennart Poettering wrote:
On Fr, 29.10.21 13:57, David Cantrell (dcantrell(a)redhat.com) wrote:
> Has there been any consideration for potential security risks with
> regards to the data in this string? Of concern to me are encoding
> formats, size limits or reporting, and structure formats. The
> proposal notes JSON, which has been involved in security related
> problems in the past.
One of the reasons we are sticking to JSON here is so that we can use
battle-tested parsers we already use for other stuff. you want a
parser that is already used, verified, tested elsewhere, and JSON
makes that easy. A homegrown parser of an entirely new special purpose
format is a lot more problematic security-wise.
In particular, the implementation in systemd is undergoing continuous
fuzzing in oss-fuzz, so we hope any simple issues have been already
caught.
Zbyszek