No work limit on normalize() in any released version (RDFC-1.0 §4.4.3), and data for choosing the 4.0.0 maxPermutations default

Aperta
  • Qualcosa non va?
#368 2 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@mielvds ci sta già lavorando.

Dal 9/11/2026.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
python
Ambito
security

Direzione di ricerca

Start by reviewing the unreleased 4.0.0 maxPermutations implementation and the RDFC-1.0 §4.4.3 requirement. Compare candidate defaults against the specification test suite and the poison-graph and acyclic-control measurements linked in the issue; done means the default is supported by evidence that it stops the cyclic attacks without rejecting legitimate inputs, with a release decision addressed.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Hello — we benchmarked RDFC-1.0 canonicalization across several implementations
for a paper we are about to post to arXiv, and we would rather give you the
numbers before it goes out than after.

What we measured

In PyLD 3.3.0 — the current PyPI release — jsonld.normalize() places no bound
on the Hash N-Degree Quads recursion. RDFC-1.0 §4.4.3 states that implementations
MUST defend against denial-of-service by raising an exception and terminating
early, and the note there suggests a call limit derived from the blank node count.

The cost of not having one is small to trigger. A complete graph K_5 — five
mutually referencing blank nodes in 527 bytes of JSON-LD — costs about
278x a plain credential. K_8, at 1,196 bytes, runs for seconds. The cost
follows the symmetry of the blank-node references rather than the document size,
so a request-size cap is not a defence: the attack fits inside any limit a
verifier would plausibly set.

We also measured what a caller can do about it today. A timeout imposed from
outside the call returns to the caller on schedule but does not stop the work —
canonicalization keeps a core busy afterwards. In Python, the only control we
found that actually interrupts the computation is a SIGALRM delivered to the
main thread, which is not available to a library consumer running in a worker
thread or under an async framework.

What we found in master

While writing this up we found that the unreleased 4.0.0 already adds
maxPermutations (default 10000) and raises
maximum canonicalization work exceeded. That addresses the issue, and we have
corrected our paper to say that no released version exposes a limit rather
than that PyLD exposes none.

Two things we think are still worth raising:

  1. There is no release that has it. pip install pyld today gives 3.3.0.
    If 4.0.0 is close, cutting it would do more for users than anything we could
    suggest here.

  2. Choosing the default is the harder half, and we have data on it. On the
    JavaScript side, rdf-canonize 5.0.0 ships maxWorkFactor=1, which stops
    every cyclic family we tried — but it also aborts acyclic inputs with 16
    and 20 blank nodes, and 18 cases of the RDFC-1.0 specification test suite.
    The clean separation we measured — every cyclic attack family stopped, every
    legitimate input admitted — appears one step looser than that. In other words
    a default tight enough to feel safe can reject well-formed credentials that
    merely have many structurally similar blank nodes, and the threshold deserves
    to be picked against measurements rather than intuition. We are happy to run
    a sweep of maxPermutations over your own corpus or test suite if that would
    be useful.

Reproducing

The poison-graph generators and the measurement harness are at
https://github.com/fujie/vcbench — the families are complete graphs K_n, rings
C_n, cubic circulants, and an acyclic forest control, so false positives are
visible as well as true positives.

On disclosure

We are not reporting this as an embargoed vulnerability and are not asking for
one. RDFC-1.0 documents dataset poisoning in §7.1 and requires a defence in
§4.4.3, so there is nothing here an attacker could not derive from the
specification; what the paper contributes is the price of the missing default,
in bytes and milliseconds on commodity hardware. We expect to post it in the
coming weeks and are glad to cite a 4.0.0 release if one lands first.

Thank you for PyLD — and for FrozenDocumentLoader, which is the other half of
what we end up recommending to verifiers.

Naohiro Fujie and Shigeya Suzuki

Lingua principale
Python
Stelle
689
Fork
140
Merge medio
2g 16h
PR unite (30g)
11

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di digitalbazaar/pyld

Tutte le issue di digitalbazaar/pyld

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.