fix(decode): reject requests with trailing non-whitespace data in DecodeJSON - #68
Closed
AdamMagued wants to merge 1 commit into
Closed
AdamMagued wants to merge 1 commit into
AdamMagued wants to merge 1 commit into
Conversation
…odeJSON json.Decoder.Decode reads a single JSON value and leaves the decoder stream positioned after that value. Previously, DecodeJSON returned immediately after the first Decode call without verifying that the stream had ended, causing requests with trailing non-whitespace data or extra JSON values after the valid payload to be accepted. Ensure no trailing non-whitespace data exists after decoding the target value by checking for io.EOF on a subsequent decode call. Add unit and regression tests for DecodeJSON and DefaultDecoder. Fixes go-chi#42
Author
|
Closing in favor of earlier PR #63 to keep the review queue clean. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #42
Problem
DecodeJSON in render/decoder.go used json.NewDecoder(r).Decode(v) without checking for trailing data after decoding the target object. Because json.Decoder is designed for streaming JSON values, trailing non-whitespace garbage or secondary JSON payloads (such as "{}\n some garbage data") were silently accepted.
Solution
After decoding the target value into v, verify that the stream has reached io.EOF by checking the result of dec.Decode(&struct{}{}). If trailing non-whitespace data or extra JSON objects exist, return the error. Payloads with trailing whitespace continue to be accepted.
Testing
Added tests in render/decoder_test.go covering: