Subject: Re: [secdir] Review of draft-brown-versioning-link-relations-05

From: Eric Rescorla <[email-masked]>
Date: Tue, 05 Jan 2010 08:57:41 -0800

At Sun, 03 Jan 2010 19:22:27 +0100,
Julian Reschke wrote:
> 
> Eric Rescorla wrote:
> > This document describes a set of link relations which provide
> > information about other versions of a versioned resource.
> > 
> > In general this mechanism seems sound but I'm not sure that
> > the security considerations are entirely adequate. This 
> > mechanism lets you learn information about other versions
> > of a resource even if you potentially don't have permission
> > to view them directly. Consider a limiting case where each
> > version of the resource had a name that contained the
> > change set for that resource. E.g.,
> > 
> > http://example.com/versions/filename/_@line_50_+_FOO;@line_60_+_BAR/;
> > 
> > In this case, seeing other parts of the version tree leaks
> > information about those versions. I don't think that this
> > is a problem for the draft, but it might be useful to
> > mention that this feature has implications for name 
> > construction.
> 
> Yes, we can mention that.
> 
> But, isn't this a general problem with exposing meta data in link 
> relations? 

Yes, probably.

> As such, shouldn't it have been mentioned in RFC 4287, and 
> should it also be mentioned in draft-nottingham-http-link-header?

Probably... I just didn't read these. :) I only did this one as part
of secdir review. 

-Ekr

---

From: Julian Reschke <[email-masked]>
Date: Wed, 06 Jan 2010 16:02:16 +0100

Hi Eric,

for now I have added:

"Care should be applied when versioned resources are subject to 
differing access policies. In this case, exposing links may leak 
information even if the linked resource itself is properly secured. In 
particular, the syntax of the link URI/IRI could expose sensitive 
information (see Section 16.2 of [RFC3253] for a similar consideration 
in WebDAV Versioning). Note that this applies to exposing link metadata 
in general, not only to links related to versioning."

to the Secutiry Considerations 
(<http://greenbytes.de/tech/webdav/draft-brown-versioning-link-relations-latest.html#rfc.issue.expose-urls>).

Is this sufficient?

Lisa: please let me know whether (and when) to submit a new draft (I'll 
assume post LC end sometimes last week?).

Best regards, Julian

-- 
<green/>bytes GmbH, Hafenweg 16, D-48155 Münster, Germany
Amtsgericht Münster: HRB5782

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 06 Jan 2010 13:34:03 -0800

This looks fine to me.

-ekr