veraison / services

Attestation verification services based on Veraison components
Apache License 2.0
26 stars 14 forks source link

profile values in absolute URI form must be quoted #257

Closed thomas-fossati closed 3 months ago

thomas-fossati commented 3 months ago

When the "profile" parameter value is an absolute URI, it must be quoted.

Rationale: the definition of parameter-value in Appendix A of RFC9110 allows both token and quoted-string, but only the latter is compatible with absolute URI syntax, which includes at least the (reserved) : following scheme.

At the moment, none of the plugins does that, see for example CCA: https://github.com/veraison/services/blob/ba78d5dec12f7fbd58ebed827b6f6fc182697209/scheme/arm-cca/scheme.go

(Note that the OID form for the profile does not need to be quoted.)