June 2010 - Ietf-types

Registration of media type application/ttaf+xml
by Philippe Le Hegaret 26 Aug '10

26 Aug '10

The following media type registration will be submitted to the IESG for review, approval, and registration with IANA (as per [1]). At this point, we would appreciate comments on this registration information. If you see any problems, please let us know. Regards, Philippe [1] http://www.w3.org/2002/06/registering-mediatype [[ This appendix registers a new MIME media type, "application/ttaf+xml" in conformance with [1144]BCP 13 and [1145]W3CRegMedia. The information in this appendix is being submitted to the Internet Engineering Steering Group (IESG) for review, approval, and registration with the Internet Assigned Numbers Authority (IANA). [1144] http://www.ietf.org/rfc/rfc4288.txt [1145] http://www.w3.org/2002/06/registering-mediatype.html MIME media type name: application MIME subtype name: ttaf+xml Required parameters: None. Optional parameters: The encoding of a TT AF document must be determined by the XML encoding declaration. This has identical semantics to the application/xml media type in the case where the charset parameter is omitted, as specified in [1146][XML Media], Sections 8.9, 8.10 and 8.11. The document profile of a TT AF document may be specified using an optional profile parameter, which, if specified, the value of which must adhere to the syntax and semantics of ttp:profile parameter defined by Section [1147]6.2.8 ttp:profile of the published specification. Encoding considerations: Same for application/xml. See [1148][XML Media], Section 3.2. Restrictions on usage: None. Security considerations: As with other XML types and as noted in [1149][XML Media] Section 10, repeated expansion of maliciously constructed XML entities can be used to consume large amounts of memory, which may cause XML processors in constrained environments to fail. In addition, because of the extensibility features for TT AF and of XML in general, it is possible that "application/ttaf+xml" may describe content that has security implications beyond those described here. However, if the processor follows only the normative semantics of the published specification, this content will be outside TT AF namespaces and may be ignored. Only in the case where the processor recognizes and processes the additional content, or where further processing of that content is dispatched to other processors, would security issues potentially arise. And in that case, they would fall outside the domain of this registration document. Interoperability considerations: The published specification describes processing semantics that dictate behavior that must be followed when dealing with, among other things, unrecognized elements and attributes, both in TT AF namespaces and in other namespaces. Because TT AF is extensible, conformant "application/ttaf+xml" processors must expect that content received is well-formed XML, but it cannot be guaranteed that the content is valid to a particular DTD or Schema or that the processor will recognize all of the elements and attributes in the document. Published specification: This media type registration is extracted from Appendix [1150]D Media Type Registration of the [1151]Timed Text (TT) Authoring Format 1.0 - Distribution Format Exchange Profile (DFXP) specification. [1151] http://www.w3.org/TR/ttaf1-dfxp/ Additional information: None. Person & email address to contact for further information: Glenn Adams (public-tt(a)w3.org) Intended usage: COMMON Author/Change controller: The published specification is a work product of the World Wide Web Consortium's Timed Text (TT) Working Group. The W3C has change control over this specification. ]] http://www.w3.org/TR/ttaf1-dfxp/#media-type-registration

7 9

Vendor-specific MIME type for review
by Tapani Otala 15 Jul '10

15 Jul '10

Hello, We would like to submit a new vendor-specific MIME type for your review. The basic idea is simple, but it did not quite fit in the IANA registration form and the recommendation was to post it to this mailing list for review. MIME media type name: application MIME subtype name: vnd.adobe.composite-asset Required parameters: final_type, final_subtype Optional parameters: none Description: This media type denotes a generic composite asset container that contains multiple sub-assets, each of which has an existing IANA registered text, image and video media types. The final type is identified by the final_type and final_subtype parameters. Sample usage: application/vnd.adobe.composite-asset; final_type=text, final_subtype=html Encoding considerations: binary This media type may require encoding on transports not capable of handling binary. Security considerations: This media type contains content that could be considered 'active' or 'executable'. However, it does not expand upon the existing security considerations already applicable to those media types. Published specification: This media type references existing IANA registered MIME types, for which there are existing specifications. Applications which use this media: Adobe Photoshop.com Web Service (http://www.photoshop.com) and its client applications. Person to contact for further information: Tapani Otala (otala(a)adobe.com) Intended usage: Limited Use The use of this media type is limited to the Photoshop.com web service and its client applications. Sincerely, Tapani Otala Sr. Engineering Manager, Photoshop.com Platform Services Adobe Systems Incorporated

4 8

Re: Registration of media typeimage/svg+xml
by Chris Lilley 18 Jun '10

18 Jun '10

On Friday, June 18, 2010, 5:50:56 PM, Henry wrote: HST> Fragment Identifiers Good point, fragment identifiers. HST> For documents labeled as application/svg+xml, the fragment identifier HST> notation is exactly that for application/xml, as specified in [RFC HST> 3023] or its successors. Except that isn't correct. There is also the SVG view syntax, described at http://dev.w3.org/SVG/profiles/1.1F2/publish/linking.html#LinksIntoSVG -- Chris Lilley mailto:chris@w3.org Technical Director, Interaction Domain W3C Graphics Activity Lead Co-Chair, W3C Hypertext CG

1 0

Registration of media typeimage/svg+xml
by Chris Lilley 18 Jun '10

18 Jun '10

Type name: image Subtype name: svg+xml Required parameters: None. Optional parameters: charset Same as application/xml media type, as specified in RFC3023 or it's successor. Encoding considerations: Same as for application/xml. See RFC3023, section 3.2. Security considerations: As with other XML types and as noted in RFC3023 section 10, repeated expansion of maliciously constructed XML entities can be used to consume large amounts of memory, which may cause XML processors in constrained environments to fail. SVG documents may be transmitted in compressed form using gzip compression. For systems which employ MIME-like mechanisms, such as HTTP, this is indicated by the Content-Transfer-Encoding header; for systems which do not, such as direct filesystem access, this is indicated by the filename extension and by the Macintosh File Type Codes. In addition, gzip compressed content is readily recognized by the initial byte sequence as described in RFC1952 section 2.3.1. Several SVG elements may cause arbitrary URIs to be referenced. In this case, the security issues of RFC3986, section 7, should be considered. In common with HTML, SVG documents may reference external media such as images, audio, video, style sheets, and scripting languages. Scripting languages are executable content. In this case, the security considerations in the Media Type registrations for those formats shall apply. In addition, because of the extensibility features for SVG and of XML in general, it is possible that "image/svg+xml" may describe content that has security implications beyond those described here. However, if the processor follows only the normative semantics of this specification, this content will be outside the SVG namespace and shall be ignored. Only in the case where the processor recognizes and processes the additional content, or where further processing of that content is dispatched to other processors, would security issues potentially arise. And in that case, they would fall outside the domain of this registration document. Interoperability considerations: This specification describes processing semantics that dictate behavior that must be followed when dealing with, among other things, unrecognized elements and attributes, both in the SVG namespace and in other namespaces. Because SVG is extensible, conformant "image/svg+xml" processors must expect that content received is well-formed XML, but it cannot be guaranteed that the content is valid to a particular DTD or Schema or that the processor will recognize all of the elements and attributes in the document. SVG has a published Test Suite and associated implementation report showing which implementations passed which tests at the time of the report. This information is periodically updated as new tests are added or as implementations improve. Published specification: This media type registration is extracted from Appendix P of the SVG 1.1 specification. http://dev.w3.org/SVG/profiles/1.1F2/publish/mimereg.html http://dev.w3.org/SVG/profiles/1.1F2/publish/index.html Applications that use this media type: SVG is used by Web browsers, often in conjunction with HTML; by mobile phones and digital cameras, as a format for interchange of graphical assets in desk top publishing, for industrial process visualization, display signage, and many other applications which require scalable static or interactive graphical capability. Additional information: Magic number(s): File extension(s): svg, svgz (if gzip-compressed) Macintosh file type code(s): "svg " (all lowercase, with a space character as the fourth letter), "svgz" (all lowercase, if gzip-compressed). Person & email address to contact for further information: Chris Lilley, Doug Schepers (member-svg-media-type(a)w3.org) Intended usage: COMMON Restrictions on usage: None Author: The SVG specification is a work product of the World Wide Web Consortium's SVG Working Group. Change controller: The W3C has change control over this specification. -- Chris Lilley mailto:chris@w3.org Technical Director, Interaction Domain W3C Graphics Activity Lead Co-Chair, W3C Hypertext CG

3 5

re: Registration of media type image/svg+xml
by Chris Lilley 18 Jun '10

18 Jun '10

Hello Mark, I have just sent a registration request for image/svg+xml to ietf-types http://www.alvestrand.no/pipermail/ietf-types/2010-June/002360.html Looking back in the archives I see an old message from you (2005!) which I don't recall answering. http://www.alvestrand.no/pipermail/ietf-types/2005-December/000903.html Some of the points no longer apply to the new registration, some are addressed. I wanted to close the loop with you on that anyway, so that if any of the items you mentioned in 2005 are not addressed to your satisfaction in the new registration, we can get them fixed. > On 12/7/05, Chris Lilley <chris at w3.org> wrote: >> >> Optional parameters: >> None >> >> The encoding of an SVG document shall be determined by the >> XML encoding declaration. This has identical semantics to the >> application/xml media type in the case where the charset >> parameter is omitted, as specified in RFC3023 sections >> 8.9, 8.10 and 8.11. > > Can I assume this section above was supposed to be a replacement for > the encoding section below? For the new registration, that text no longer appears. To answer your question though: no, its one of those unfortunate terminology issues where different terms are used by different communities. What XML calls the 'encoding' or 'character encoding' is what IETF calls the 'charset'. So the section was in the right place and was explaining the lack of a charset parameter. However, the new registration has the optional charset parameter so no longer needs the explanatory prose. >> Security considerations: >> SVG documents may be transmitted in compressed form using >> gzip compression. For systems which employ MIME-like >> mechanisms, such as HTTP, this is indicated by the >> Content-Transfer-Encoding header; for systems which do not, >> such as direct filesystem access, this is indicated by the >> filename extension and by the Macintosh File Type Codes. In >> addition, gzip compressed content is readily recognised by >> the initial byte sequence as described in RFC1952 section >> 2.3.1. > > I don't see how that's a security issue. Seems more an encoding one to me. I agree it could be described either way, but there have been concerns in the past about triggering compression libraries and potential security concerns due to fixed-length zlib buffers so on balance, we decided to leave that text in there. A secondary reason to mention it was that a few implementations accept uncompressed svg, but fail with compressed svg, or only allow compressed svg when served over http and not from local disk. So it seemed worth mentioning the various ways that compressed svg might be labelled or detected. If you strongly disagree though, and no-one else speaks up in favour of this being worth mentioning in the security section, we are happy to take it out or move it to the encoding section. Should the initial byte sequence of gzipped svg be mentioned under magic numbers? It only shows that the content is gzipped, not that it is svg, so we did not add it there. > On the topic of compression though, I had heard a while ago (back in > the "image/svg-xml" days) that compressed SVG is sometimes sent as > image/svg+xml. Is that still (assuming it was ever) the case? Yes, it is the case. The same media type is used for svg regardless of whether it is compressed or not. For HTTP, other labelling is used to indicate the compression. > The > spec seems to make it clear that SVG is compressed via HTTP > compression. Yes. >> Published specification: >> This media type registration is extracted from Appendix M of >> the SVG 1.2 Tiny specification. >> http://www.w3.org/TR/SVGMobile12 > > There was no "Applications which used this media type" section. I > think it would be useful to say that there are numerous > implementations which currently support this media type. This has been added to the current registration; please check that the language is satisfactory. > Also, you might want to mention - probably in "interoperability" - > that this same media type was also prescribed for use in the SVG 1.0 > and 1.1 specs. And if there are any backward compatibility issues > between 1.2 and those, you might want to say something about that. The current registration is in the context of SVG 1.1, while the old one was for SVG Tiny 1.2 SVG 1.1 obsoletes SVG 1.0 (but SVG 1.0 did use the same media type) The same media type is used for SVG Tiny 1.1, SVG Basic 1.1, and SVG Tiny 1.2. We would be happy to note this in the registration, although the defining specification covers the relationship in much more detail. -- Chris Lilley mailto:chris@w3.org Technical Director, Interaction Domain W3C Graphics Activity Lead Co-Chair, W3C Hypertext CG

1 0

Request for review of media type registration in draft-santoni-media-type-tsd-00.txt
by Adriano.Santoni 03 Jun '10

03 Jun '10

Hi all, would you please revise the media type registration in http://www.ietf.org/id/draft-santoni-media-type-tsd-00.txt Thanks Adriano Santoni

2 1