Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Warn of the dangers of malicious text #262

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Warn of the dangers of malicious text #262

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions draft-ietf-oauth-sd-jwt-vc.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1092,6 +1092,22 @@ These measures allow the Consumers to continue to function even if
the metadata server is temporarily unavailable and avoid privacy issues as
described in (#privacy-preserving-retrieval-of-type-metadata).

## Risks Associated with Displaying Textual Information {#risks-displaying-textual-information}

The `display` property in the Type Metadata allows providers of metadata to
specify human-readable labels and descriptions for claims. Likewise, `name` and
`description` can contain arbitrary textual information that may be displayed to
developers. As such, any consuming application MUST ensure that maliciously
crafted information cannot be used to compromise the security of the application
or the privacy of the user. To this end, the following considerations apply:

- The consuming application MUST ensure that the text is properly escaped before
displaying it to the user or transferring it into other contexts. For example,
if the data is displayed in an HTML document, the text MUST be properly
escaped to prevent Cross-Site Scripting (XSS) attacks.
- The consuming application MUST ensure that the display of the user interface
elements cannot be distorted by overly long text or special characters.

Comment on lines +1095 to +1110
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
## Risks Associated with Displaying Textual Information {#risks-displaying-textual-information}
The `display` property in the Type Metadata allows providers of metadata to
specify human-readable labels and descriptions for claims. Likewise, `name` and
`description` can contain arbitrary textual information that may be displayed to
developers. As such, any consuming application MUST ensure that maliciously
crafted information cannot be used to compromise the security of the application
or the privacy of the user. To this end, the following considerations apply:
- The consuming application MUST ensure that the text is properly escaped before
displaying it to the user or transferring it into other contexts. For example,
if the data is displayed in an HTML document, the text MUST be properly
escaped to prevent Cross-Site Scripting (XSS) attacks.
- The consuming application MUST ensure that the display of the user interface
elements cannot be distorted by overly long text or special characters.
## Risks Associated with Textual Information {#risks-textual-information}
Some claims in the SD-JWT VC and properties in the Type Metadata, e.g., `display`, allows issuers and providers of metadata to
specify human-readable information. These can contain arbitrary textual information that
may be displayed to developers. As such, any consuming application MUST ensure that maliciously
crafted information cannot be used to compromise the security of the application
or the privacy of the user. To this end, the following considerations apply:
- The consuming application MUST ensure that the text is properly escaped before
displaying it to the user or transferring it into other contexts. For example,
if the data is displayed in an HTML document, the text MUST be properly
escaped to prevent Cross-Site Scripting (XSS) attacks.
- The consuming application MUST ensure that the display of the user interface
elements cannot be distorted by overly long text or special characters.

# Privacy Considerations {#privacy-considerations}

The Privacy Considerations in the SD-JWT specification
Expand Down
Loading