@@ -2235,12 +2235,16 @@ <h3>Verify Proof Sets and Chains</h3>
2235
2235
< h3 > Context Validation</ h3 >
2236
2236
2237
2237
< p >
2238
- This section contains an algorithm that applications validating a [=conforming
2239
- secured document=] MUST run after running the algorithm in Section
2240
- [[[#verify-proof]]] or Section [[[#verify-proof-sets-and-chains]]]. This
2241
- algorithm takes a document ([=map=] |inputDocument|) and a set of approved
2242
- JSON-LD Contexts ([=map=] |approvedContexts|), and returns a [=map=] that
2243
- contains the following:
2238
+ The purpose of the algorithm in this section is to ensure that a consuming
2239
+ application has explicitly approved of the types, and therefore the semantics,
2240
+ of input documents that it will process. Not checking JSON-LD context values
2241
+ against known good values can lead to security vulnerabilities, due to variance
2242
+ in the semantics that they convey. The context validation algorithm is one
2243
+ that applications validating a [=conforming secured document=] MUST run after
2244
+ running the algorithm in Section [[[#verify-proof]]] or Section
2245
+ [[[#verify-proof-sets-and-chains]]]. This algorithm takes a document ([=map=]
2246
+ |inputDocument|) and a set of approved JSON-LD Contexts ([=map=]
2247
+ |approvedContexts|), and returns a [=map=] that contains the following:
2244
2248
</ p >
2245
2249
2246
2250
< ul >
@@ -2282,7 +2286,7 @@ <h3>Context Validation</h3>
2282
2286
If the context value does not exist in |approvedContexts|:
2283
2287
< ol class ="algorithm ">
2284
2288
< li >
2285
- Optionally, remove the |contextValue| from the `@context` property values.
2289
+ Optionally, remove the |contextValue| from the `@context` property values.
2286
2290
</ li >
2287
2291
< li >
2288
2292
Set |result|.|document| to the result of running the
@@ -2305,13 +2309,10 @@ <h3>Context Validation</h3>
2305
2309
</ ol >
2306
2310
2307
2311
< p >
2308
- The purpose of the algorithm above is to ensure that a consuming application has
2309
- explicitly approved of the types, and therefore the semantics, of input documents
2310
- that it will process. Not checking JSON-LD context values against known good values
2311
- can lead to security vulnerabilities, due to variance in the semantics that they
2312
- convey. While the algorithm above provides one way of checking these context values,
2313
- and one optional way of safely processing unknown values, there are other approaches
2314
- that can provide the same protections.
2312
+ While the algorithm above provides one way of checking these values, and one
2313
+ optional way of safely processing unknown values, implementers MAY use
2314
+ alternative approaches, or a different ordering of the steps, that provide the
2315
+ same protections.
2315
2316
</ p >
2316
2317
2317
2318
< p >
0 commit comments