Collected research
Unexpected security footguns in Go's parsers
Go's JSON, XML and YAML parsers are surprisingly lenient: a dash struct tag with omitempty leaves the field settable, JSON matching is case-insensitive and keeps the last duplicate key, and the XML parser accepts garbage around the document. This lets an attacker set fields meant to be private, or send one body that a proxy and an authorization service read differently.
Record
- Published by
- The Trail of Bits Blog
- Date
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of The Trail of Bits Blog, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .