DecodeJSON accepts "{}\n some garbage data" incorrectly
Open
- Dominant language
- Go
- Stars
- 339
- Forks
- 66
- PR merge metrics
- No merged PRs in 30d
Description
Because json.NewDecoder expects to decode a stream of objects, it lets malicious clients add garbage data to the end of a request, which may lead to a "confused deputy" security bug.
See https://github.com/golang/go/issues/36225.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.