Limit Content-Encoding?
@jyasskin is already working on this.
Since Mar 27, 2019.
- Dominant language
- Go
- Stars
- 1.3k
- Forks
- 125
- PR merge metrics
- No merged PRs in 30d
Description
The chromium implementation doesn't support any inner content-encodings other than mi-sha256-03.
-
Should the implementation snapshot document this upper bound? (And, AFAICT, it's also a lower bound via signature validity step 9.)
-
Should the draft spec place any limits or suggestion on inner content-encoding? I don't suppose it could specify an allowed list of content encodings because that would preclude future integrity specs. But perhaps it could ban br, deflate, and gzip (unless there's a good reason to specify those on inner rather than outer). Perhaps it could mandate a maximum of one, but maybe that would preclude some future
Digestheader that requires nested encodings.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.