3 ms·
What is a bug in the spec? Or in a part that was not formally verified?
by jraph 4y ago
What is a bug in the spec? Or in a part that was not formally verified?
- hinkley 4y agoThere are a couple of presentations out there about how challenging it is to use XML-Sig correctly. The XML part introduces a whole raft of ambiguities. Chief amongst them is document.getElementByID() and element.getElementByID() can return different answers. Compression file formats have similar ambiguities you need to work out to avoid doppelgängers, and then also avoid overwriting system files via canonical path bugs. Essentially the answer depends on who you ask. For my part I would say both.