No work limit on normalize() in any released version (RDFC-1.0 §4.4.3), and data for choosing the 4.0.0 maxPermutations default

Abierto
  • ¿Algo no está bien?
#368 2 comentarios 0 reacciones 1 asignado Ver en GitHub

Los mantenedores suelen responder en 1 día

@mielvds ya está trabajando en esto.

Desde el 9/11/2026.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
35/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
python
Área
security

Línea de trabajo

Start by reviewing the unreleased 4.0.0 maxPermutations implementation and the RDFC-1.0 §4.4.3 requirement. Compare candidate defaults against the specification test suite and the poison-graph and acyclic-control measurements linked in the issue; done means the default is supported by evidence that it stops the cyclic attacks without rejecting legitimate inputs, with a release decision addressed.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Hello — we benchmarked RDFC-1.0 canonicalization across several implementations
for a paper we are about to post to arXiv, and we would rather give you the
numbers before it goes out than after.

What we measured

In PyLD 3.3.0 — the current PyPI release — jsonld.normalize() places no bound
on the Hash N-Degree Quads recursion. RDFC-1.0 §4.4.3 states that implementations
MUST defend against denial-of-service by raising an exception and terminating
early, and the note there suggests a call limit derived from the blank node count.

The cost of not having one is small to trigger. A complete graph K_5 — five
mutually referencing blank nodes in 527 bytes of JSON-LD — costs about
278x a plain credential. K_8, at 1,196 bytes, runs for seconds. The cost
follows the symmetry of the blank-node references rather than the document size,
so a request-size cap is not a defence: the attack fits inside any limit a
verifier would plausibly set.

We also measured what a caller can do about it today. A timeout imposed from
outside the call returns to the caller on schedule but does not stop the work —
canonicalization keeps a core busy afterwards. In Python, the only control we
found that actually interrupts the computation is a SIGALRM delivered to the
main thread, which is not available to a library consumer running in a worker
thread or under an async framework.

What we found in master

While writing this up we found that the unreleased 4.0.0 already adds
maxPermutations (default 10000) and raises
maximum canonicalization work exceeded. That addresses the issue, and we have
corrected our paper to say that no released version exposes a limit rather
than that PyLD exposes none.

Two things we think are still worth raising:

  1. There is no release that has it. pip install pyld today gives 3.3.0.
    If 4.0.0 is close, cutting it would do more for users than anything we could
    suggest here.

  2. Choosing the default is the harder half, and we have data on it. On the
    JavaScript side, rdf-canonize 5.0.0 ships maxWorkFactor=1, which stops
    every cyclic family we tried — but it also aborts acyclic inputs with 16
    and 20 blank nodes, and 18 cases of the RDFC-1.0 specification test suite.
    The clean separation we measured — every cyclic attack family stopped, every
    legitimate input admitted — appears one step looser than that. In other words
    a default tight enough to feel safe can reject well-formed credentials that
    merely have many structurally similar blank nodes, and the threshold deserves
    to be picked against measurements rather than intuition. We are happy to run
    a sweep of maxPermutations over your own corpus or test suite if that would
    be useful.

Reproducing

The poison-graph generators and the measurement harness are at
https://github.com/fujie/vcbench — the families are complete graphs K_n, rings
C_n, cubic circulants, and an acyclic forest control, so false positives are
visible as well as true positives.

On disclosure

We are not reporting this as an embargoed vulnerability and are not asking for
one. RDFC-1.0 documents dataset poisoning in §7.1 and requires a defence in
§4.4.3, so there is nothing here an attacker could not derive from the
specification; what the paper contributes is the price of the missing default,
in bytes and milliseconds on commodity hardware. We expect to post it in the
coming weeks and are glad to cite a 4.0.0 release if one lands first.

Thank you for PyLD — and for FrozenDocumentLoader, which is the other half of
what we end up recommending to verifiers.

Naohiro Fujie and Shigeya Suzuki

Lenguaje dominante
Python
Estrellas
689
Forks
140
Merge medio
2 d 16 h
PR fusionados (30 d)
11

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de digitalbazaar/pyld

Todos los issues de digitalbazaar/pyld

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.