Re: Start parameter in MIFFY/MTOM

Jacek,

This scenario would typically be used on intrAnets, so there is less 
risk of denial-of-service attacks.

Jean-Jacques.

Jacek Kopecky wrote:

> Jean-Jacques,
> 
> so your implementation will first blindly accept and buffer an
> attachment, then read the rest of the message and do all the necessary
> SOAP processing (mU checks etc.) and then it will process the body,
> using the pre-buffered attachment? So if I understand correctly, you
> stream-in the SOAP Body (with a print job, I presume) and just start
> printing using the image. But isn't this amenable to denial-of-service
> attacks?
> 
> Maybe your implementation has some limit on the size of the background
> image and can afford to waste that space if the SOAP processing fails
> (and it faults if the pre-SOAP part is too big). Am I right?
> 
> OK, I can see the usecase and how it might be implemented, but we must
> spell it out quite clearly, if we in fact allow the SOAP part not to be
> the first in the MIME package.
> 
> Best regards,
> 
>                    Jacek Kopecky
> 
>                    Systinet Corporation
>                    http://www.systinet.com/
> 
> 
> 
> 
> On Fri, 2004-01-16 at 15:32, Jean-Jacques Moreau wrote:
> 
>>Jacek,
>>
>>We do have a usecase where we have a background image to print on each 
>>page, and we want that image to appear first in the serialization.
>>
>>Jean-Jacques.
>>
>>Jacek Kopecky wrote:
>>
>>>Herve,
>>>
>>>I wonder what are the usecases for putting the root part elsewhere than
>>>the first part (necessitating the use of the start parameter). After
>>>all, we expect that the SOAP part is relatively small and that is the
>>>part that contains the instruction on what to do with the incoming
>>>message (including the attachments, of course).
>>>
>>>I can't imagine (at the moment) an application that would blindly accept
>>>a potentially large attachment before receiving the part that requires
>>>mustUnderstand checks, for example. It looks like a very good target of
>>>denial-of-service attacks.
>>>
>>>Best regards,
>>>
>>>                   Jacek Kopecky
>>>
>>>                   Systinet Corporation
>>>                   http://www.systinet.com/
>>>
>>>
>>>
>>>
>>>
>>>
>>>On Wed, 2004-01-14 at 13:03, Herve Ruellan wrote:
>>>
>>>
>>>>Dear all,
>>>>
>>>>I would like to make sure that all MIFFY or MTOM implementations 
>>>>supporting Multipart/Related packages have to support the "Start" parameter.
>>>>From reading between the lines of the last MIFFY spec [1], I think this 
>>>>is the case, but I would prefer if it was explicitely said in section 2.1.
>>>>
>>>>Best regards,
>>>>
>>>>Hervé.
>>>>
>>>>[1] http://lists.w3.org/Archives/Public/xml-dist-app/2004Jan/0023.html.
>>>>
>>>
>>>
>

Received on Friday, 16 January 2004 09:58:28 UTC