Skip to content

Commit 3107ccb

Browse files
committed
Move explanation of purpose to top of context validation algorithm.
1 parent 7a55f79 commit 3107ccb

File tree

1 file changed

+15
-14
lines changed

1 file changed

+15
-14
lines changed

index.html

Lines changed: 15 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -2235,12 +2235,16 @@ <h3>Verify Proof Sets and Chains</h3>
22352235
<h3>Context Validation</h3>
22362236

22372237
<p>
2238-
This section contains an algorithm that applications validating a [=conforming
2239-
secured document=] MUST run after running the algorithm in Section
2240-
[[[#verify-proof]]] or Section [[[#verify-proof-sets-and-chains]]]. This
2241-
algorithm takes a document ([=map=] |inputDocument|) and a set of approved
2242-
JSON-LD Contexts ([=map=] |approvedContexts|), and returns a [=map=] that
2243-
contains the following:
2238+
The purpose of the algorithm in this section is to ensure that a consuming
2239+
application has explicitly approved of the types, and therefore the semantics,
2240+
of input documents that it will process. Not checking JSON-LD context values
2241+
against known good values can lead to security vulnerabilities, due to variance
2242+
in the semantics that they convey. The context validation algorithm is one
2243+
that applications validating a [=conforming secured document=] MUST run after
2244+
running the algorithm in Section [[[#verify-proof]]] or Section
2245+
[[[#verify-proof-sets-and-chains]]]. This algorithm takes a document ([=map=]
2246+
|inputDocument|) and a set of approved JSON-LD Contexts ([=map=]
2247+
|approvedContexts|), and returns a [=map=] that contains the following:
22442248
</p>
22452249

22462250
<ul>
@@ -2282,7 +2286,7 @@ <h3>Context Validation</h3>
22822286
If the context value does not exist in |approvedContexts|:
22832287
<ol class="algorithm">
22842288
<li>
2285-
Optionally, remove the |contextValue| from the `@context` property values.
2289+
Optionally, remove the |contextValue| from the `@context` property values.
22862290
</li>
22872291
<li>
22882292
Set |result|.|document| to the result of running the
@@ -2305,13 +2309,10 @@ <h3>Context Validation</h3>
23052309
</ol>
23062310

23072311
<p>
2308-
The purpose of the algorithm above is to ensure that a consuming application has
2309-
explicitly approved of the types, and therefore the semantics, of input documents
2310-
that it will process. Not checking JSON-LD context values against known good values
2311-
can lead to security vulnerabilities, due to variance in the semantics that they
2312-
convey. While the algorithm above provides one way of checking these context values,
2313-
and one optional way of safely processing unknown values, there are other approaches
2314-
that can provide the same protections.
2312+
While the algorithm above provides one way of checking these values, and one
2313+
optional way of safely processing unknown values, implementers MAY use
2314+
alternative approaches, or a different ordering of the steps, that provide the
2315+
same protections.
23152316
</p>
23162317

23172318
<p>

0 commit comments

Comments
 (0)