search

IIIF / api

Source for API and model specifications documents (api and model)
http://iiif.io/api
105 stars 54 forks source link

service key collides with service URI scheme in JSON-LD expansion #668

Closed azaroth42 closed 8 years ago

azaroth42 commented 8 years ago

Issue:

JSON-LD expansion is greedy when it comes to looking for terms in the context that match the beginning of a string followed by a colon. Thus in the worst case, if we defined a key called 'http' with a definition of "http://example.com/steal/things/", then the value "http://iiif.io/" would be expanded to "http://example.com/steal/things///iiif.io/" :(

At the moment we are vulnerable to one such unintended expansion: service. There is a URI scheme for services defined in RFC2609, and corresponding protocol in RFC2608. So if someone were to use a service uri it would be incorrectly expanded. From the RFC, an example is: service:device-drivers:tftp://x2.bean.org/vol3/disk/drivers.drv;driver=scsi;platform=sys3.2-rs3000

Which would expand to: http://rdfs.org/sioc/services#has_service:device-drivers:tftp://x2.bean.org/vol3/disk/drivers.drv;driver=scsi;platform=sys3.2-rs3000

Not a big deal (clearly) but perhaps we should write an implementation note recording the issue?

References:

azaroth42 commented 8 years ago

And also resource, having written code to systematically check contexts. The resource URI scheme is provisional, only implemented in Firefox, with no comprehensible description of what it actually does:

http://www.iana.org/assignments/uri-schemes/prov/resource

azaroth42 commented 8 years ago

I propose a JSON-LD implementation note that references the frame documents, describes this issue, the related sizeByW expansion issue, that we don't consider the mappings to be subject to semver, the rationale behind the HTML/language decision and any other JSON-LD stuff we run into.

We could also put the expansion checking code into Travis to run on any context.json file?

jpstroop commented 8 years ago

Sounds like you're filling up your holidays with projects!

-Js

Sent via mobile. Please excuse typos, brevity, etc.

azaroth42 commented 8 years ago

Heh. Actually am trying to get them all done before family arrive from NZ :)