From 12995c3fdf322e2adf7967b01e76f3ef3b0e0133 Mon Sep 17 00:00:00 2001
From: Julian Reschke <reschke@apache.org>
Date: Tue, 19 Nov 2024 16:05:11 +0100
Subject: [PATCH 1/2] query: conditional queries (fixes #1917)

---
 draft-ietf-httpbis-safe-method-w-body.xml | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/draft-ietf-httpbis-safe-method-w-body.xml b/draft-ietf-httpbis-safe-method-w-body.xml
index 45a9fee15..8fb780f76 100644
--- a/draft-ietf-httpbis-safe-method-w-body.xml
+++ b/draft-ietf-httpbis-safe-method-w-body.xml
@@ -288,14 +288,11 @@ q=foo&amp;limit=10&amp;sort=-published
 
     <section title="Conditional Requests" anchor="conditional">
     <t>
-      The semantics of the QUERY method change to a "conditional QUERY" if
-      the request message includes an If-Modified-Since, If-Unmodified-
-      Since, If-Match, If-None-Match, or If-Range header field
-      (<xref target="HTTP" sectionFormat="comma" section="13"/>).  A conditional QUERY requests that the query
-      be performed only under the circumstances described by the conditional
-      header field(s). It is important to note, however, that such conditions
-      are evaluated against the state of the target resource itself as opposed
-      to the collected results of the query operation.
+      A conditional QUERY requests that the selected representation
+      (i.e., the query results, after any content negotiation) be
+      returned in the response only under the circumstances described by the
+      conditional header field(s), as defined in
+      <xref target="HTTP" section="13"/>.
     </t>
     </section>
 
@@ -682,6 +679,7 @@ Dubois, Camille, camille.dubois@example.net
 <section title="Since draft-ietf-httpbis-safe-method-w-body-06" anchor="changes.since.06">
 <ul>
   <li>Improve language about sensitive information in URIs (<eref target="https://github.com/httpwg/http-extensions/issues/1895"/>)</li>
+  <li>Clarified description of conditional queries (<eref target="https://github.com/httpwg/http-extensions/issues/1917"/>)</li>
   <li>Editorial changes to Introduction (ack Will Hawkins, <eref target="https://github.com/httpwg/http-extensions/pull/2859"/>)</li>
   <li>Added CORS considerations (<eref target="https://github.com/httpwg/http-extensions/issues/2898"/>)</li>
   <li>SQL media type is application/sql (RFC6922) (<eref target="https://github.com/httpwg/http-extensions/issues/2936"/>)</li>

From 61ebb4065af7d89c531e0c1df7a348716a3493a1 Mon Sep 17 00:00:00 2001
From: Julian Reschke <reschke@apache.org>
Date: Wed, 20 Nov 2024 13:35:57 +0100
Subject: [PATCH 2/2] query: Added Security Consideration with respect to
 Normalization (closes #2896)

---
 draft-ietf-httpbis-safe-method-w-body.xml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/draft-ietf-httpbis-safe-method-w-body.xml b/draft-ietf-httpbis-safe-method-w-body.xml
index 8fb780f76..7669c2c86 100644
--- a/draft-ietf-httpbis-safe-method-w-body.xml
+++ b/draft-ietf-httpbis-safe-method-w-body.xml
@@ -361,6 +361,11 @@ Accept-Query = 1#media-type
       resource &SHOULD; be chosen such that it does not include any sensitive
       portions of the original request content.
     </t>
+    <t>
+      Caches that normalize QUERY content incorrectly or in ways that are
+      significantly different than how the resource processes the content
+      can return the incorrect response if normalization results in a false positive.
+    </t>
     <t>
       A QUERY request from user agents implementing CORS (Cross-Origin Resource Sharing)
       will require a "preflight" request,
@@ -681,6 +686,7 @@ Dubois, Camille, camille.dubois@example.net
   <li>Improve language about sensitive information in URIs (<eref target="https://github.com/httpwg/http-extensions/issues/1895"/>)</li>
   <li>Clarified description of conditional queries (<eref target="https://github.com/httpwg/http-extensions/issues/1917"/>)</li>
   <li>Editorial changes to Introduction (ack Will Hawkins, <eref target="https://github.com/httpwg/http-extensions/pull/2859"/>)</li>
+  <li>Added Security Consideration with respect to Normalization (<eref target="https://github.com/httpwg/http-extensions/issues/2896"/>)</li>
   <li>Added CORS considerations (<eref target="https://github.com/httpwg/http-extensions/issues/2898"/>)</li>
   <li>SQL media type is application/sql (RFC6922) (<eref target="https://github.com/httpwg/http-extensions/issues/2936"/>)</li>
   <li>Added overview table to introduction (<eref target="https://github.com/httpwg/http-extensions/issues/2951"/>)</li>