attachment-0001
Hi,<br><br>Thanks for the DEL catch James!<br><br>Mike - bullet (2) (MUST NOT accept/transfer controls except CR or LF)<br>runs afoul of the ABNF for "ipp-printer-device-id" in [PWG5107.2] which<br>also allows HT (per IEEE 1284 parent spec).<br>
<br>And for attributes shared/coordinated w/ IETF or PWG MIBs, note that<br>DisplayString (RFC 2579) allows NVT-ASCII per TELNET (RFC 853),<br>which defines several control characters but allows *all* of the C0 control <br>
characters.<br><br>Examples of ASCII attributes include: sysDescr, sysName, sysLocation,<br>sysContact, and hrDeviceDescr.<br><br>Examples of ambiguous (OCTET STRING) charset attributes (often UTF-8) <br>include: prtGeneralPrinterName, prtGeneralServicePerson, and <br>
prtGeneralCurrentOperator, and prtGeneralSerialNumber.<br><br>I have personally seen quite a few MIB walks of printers w/ HT and/or VT<br>in their sysLocation or sysContact values.<br><br>Cheers,<br>- Ira<br><br><br clear="all">
Ira McDonald (Musician / Software Architect)<br>Chair - Linux Foundation Open Printing WG<br>Secretary - IEEE-ISTO Printer Working Group<br>Co-Chair - IEEE-ISTO PWG IPP WG<br>Co-Chair - TCG Trusted Mobility Solutions WG<br>
Chair - TCG Embedded Systems Hardcopy SG<br>IETF Designated Expert - IPP & Printer MIB<br>Blue Roof Music/High North Inc<br><a style="color:rgb(51,51,255)" href="http://sites.google.com/site/blueroofmusic" target="_blank">http://sites.google.com/site/blueroofmusic</a><br>
<a style="color:rgb(102,0,204)" href="http://sites.google.com/site/highnorthinc" target="_blank">http://sites.google.com/site/highnorthinc</a><br>mailto:<a href="mailto:blueroofmusic@gmail.com" target="_blank">blueroofmusic@gmail.com</a><br>
Winter 579 Park Place Saline, MI 48176 734-944-0094<br>Summer PO Box 221 Grand Marais, MI 49839 906-494-2434<div style="display:inline"></div><div style="display:inline"></div><div style="display:inline"></div><div>
</div><div></div><div></div><div></div><br>
<br><br><div class="gmail_quote">On Thu, May 10, 2012 at 2:03 PM, Michael Sweet <span dir="ltr"><<a href="mailto:msweet@apple.com" target="_blank">msweet@apple.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Good catch, yes DEL should also be banned (it is in 5198)<br>
<br>
On May 10, 2012, at 10:57 AM, James Howard Young <<a href="mailto:jyoung@gsu.edu">jyoung@gsu.edu</a>> wrote:<br>
<br>
> Hello Michael,<br>
><br>
> If you wish to disallow US-ASCII CONTROL chararacters in name<br>
> values (and this is probably a good thing) then you might<br>
> also want to consider disallowing decimal 127 (0x7f, octal 177)<br>
> as well. This is the dredded ASCII "DEL" character.<br>
><br>
> Here's a couple of quick links to some ASCII tables:<br>
><br>
> <a href="http://www.asciitable.com/" target="_blank">http://www.asciitable.com/</a><br>
> <a href="http://www.table-ascii.com/" target="_blank">http://www.table-ascii.com/</a><br>
><br>
> Sincerely,<br>
><br>
> Jim Young<br>
> Long ago print server implementer<br>
<div><div class="h5">><br>
> On 5/10/12 1:24 PM, "Michael Sweet" <<a href="mailto:msweet@apple.com">msweet@apple.com</a>> wrote:<br>
><br>
>><br>
>><br>
>><br>
>> All,<br>
>><br>
>><br>
>> I recently got a CUPS bug report (<a href="http://www.cups.org/str.php?L4072" target="_blank">http://www.cups.org/str.php?L4072</a>)<br>
>> where control characters in the job-name value were causing problems with<br>
>> a particular IPP printer.<br>
>><br>
>><br>
>> In doing some research on what is allowed for a name value, it seems that<br>
>> RFC 2911 and 3196 don't go beyond referencing the RFCs defining UTF-8<br>
>> (3629) and US-ASCII (2045), and I don't see anything in those documents<br>
>> that would prevent the use of control<br>
>> characters in the range of 0 to 31 (decimal). Appendix B of RFC 5198<br>
>> (Unicode Format for Network Interchange) talks a bit about this issue but<br>
>> doesn't make any normative requirements.<br>
>><br>
>><br>
>> Given the interoperability and security implications of control<br>
>> characters in name and text values, I would like to document the issues<br>
>> and possibly add some normative requirements. Here is what I'd like to<br>
>> add to IPP Everywhere:<br>
>><br>
>><br>
>> 1. Clients and Printers MUST NOT accept or transfer name values<br>
>> containing control characters. For US-ASCII that covers the characters<br>
>> from 0x00 to 0x1F (C0) and for UTF-8/Unicode it covers the characters<br>
>> from 0x00 to 0x1F (C0) and 0x80 to 0x9F (C1).<br>
>><br>
>><br>
>> 2. Clients and Printers MUST NOT accept or transfer text values<br>
>> containing control characters other than CR and LF.<br>
>><br>
>><br>
>> 3. Implementation guidance for Create-Job/Print-Job/Print-URI: Printers<br>
>> MAY filter out disallowed characters in job-name but MUST return job-name<br>
>> in the unsupported attributes group. Status code is<br>
>> client-error-unsupported-attributes-or-values (for<br>
>> ipp-attribute-fidelity=true<br>
>> or job-mandatory-attributes=job-name) or<br>
>> successful-ok-ignored-or-substituted-attributes (otherwise).<br>
>><br>
>><br>
>> 4. Add discussion of security considerations for logging of control<br>
>> characters, specific reference to RFC 5198.<br>
>><br>
>><br>
>> Thoughts?<br>
>><br>
>><br>
>> __________________________________________________<br>
>> Michael Sweet, Senior Printing System Engineer, PWG Chair<br>
>><br>
>><br>
>><br>
>><br>
>><br>
>> --<br>
>> This message has been scanned for viruses and<br>
</div></div>>> dangerous content by MailScanner <<a href="http://www.mailscanner.info/" target="_blank">http://www.mailscanner.info/</a>>, and is<br>
<div class="im">>><br>
>> believed to be clean.<br>
>><br>
>><br>
>><br>
><br>
><br>
><br>
<br>
__________________________________________________<br>
Michael Sweet, Senior Printing System Engineer, PWG Chair<br>
<br>
<br>
--<br>
This message has been scanned for viruses and<br>
dangerous content by MailScanner, and is<br>
believed to be clean.<br>
<br>
</div>_______________________________________________<br>
ipp mailing list<br>
<a href="mailto:ipp@pwg.org">ipp@pwg.org</a><br>
<a href="https://www.pwg.org/mailman/listinfo/ipp" target="_blank">https://www.pwg.org/mailman/listinfo/ipp</a><br>
</blockquote></div><br>
<br />--
<br />This message has been scanned for viruses and
<br />dangerous content by
<a href="http://www.mailscanner.info/"><b>MailScanner</b></a>, and is
<br />believed to be clean.