json: reject trailing data after a payload

decoder.go

@@ -37,10 +37,15 @@ func DefaultDecoder(r *http.Request, v interface{}) error {
 	return err
 }
 
-// DecodeJSON decodes a given reader into an interface using the json decoder.
+// DecodeJSON decodes a given reader into an interface using encoding/json.
+// json.Unmarshal rejects trailing data after a single value (golang/go#36225);
+// Decoder.Decode does not.
 func DecodeJSON(r io.Reader, v interface{}) error {
-	defer io.Copy(io.Discard, r) //nolint:errcheck
-	return json.NewDecoder(r).Decode(v)
+	data, err := io.ReadAll(r)
+	if err != nil {
+		return err
+	}
+	return json.Unmarshal(data, v)
 }
 
 // DecodeXML decodes a given reader into an interface using the xml decoder.

decoder_test.go

@@ -0,0 +1,50 @@
+package render
+
+import (
+	"bytes"
+	"net/http"
+	"strings"
+	"testing"
+)
+
+func TestDecodeJSONRejectsTrailingData(t *testing.T) {
+	var v map[string]interface{}
+	err := DecodeJSON(strings.NewReader("{}\n some garbage data"), &v)
+	if err == nil {
+		t.Fatal("expected error for trailing garbage after JSON object")
+	}
+}
+
+func TestDecodeJSONAllowsTrailingWhitespace(t *testing.T) {
+	var v map[string]string
+	if err := DecodeJSON(strings.NewReader("{\"a\":\"b\"}\n\t "), &v); err != nil {
+		t.Fatal(err)
+	}
+	if v["a"] != "b" {
+		t.Fatalf("got %#v", v)
+	}
+}
+
+func TestDecodeJSONValidObject(t *testing.T) {
+	var v struct {
+		N int `json:"n"`
+	}
+	if err := DecodeJSON(bytes.NewReader([]byte(`{"n":7}`)), &v); err != nil {
+		t.Fatal(err)
+	}
+	if v.N != 7 {
+		t.Fatalf("got %d", v.N)
+	}
+}
+
+func TestDefaultDecoderJSONTrailingData(t *testing.T) {
+	r, err := http.NewRequest(http.MethodPost, "/", strings.NewReader("{}\n extra"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	r.Header.Set("Content-Type", "application/json")
+	var v map[string]interface{}
+	if err := DefaultDecoder(r, &v); err == nil {
+		t.Fatal("expected trailing-data error")
+	}
+}