Documentation
¶
Overview ¶
Package jsonstrict adds the strictness encoding/json does not provide.
It lives in internal/ because both the root package and api/ need it and neither imports the other. Nothing here is part of the public API.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrDuplicateKey = errors.New("request body contains a duplicate JSON key")
ErrDuplicateKey is returned when a request body names the same object member twice.
Functions ¶
func RejectDuplicateKeys ¶
RejectDuplicateKeys reports an error if any object in the document names the same member twice.
encoding/json silently takes the last occurrence: {"role":"user","role":"admin"} unmarshals to "admin" with no error. That is a smuggling primitive whenever anything else in the request path -- a proxy, a WAF, a gateway, an audit log -- parses the same body and resolves the conflict differently. Two components disagreeing about what a request said is the whole bug class.
encoding/json/v2 rejects duplicates, but only through its own API. Go 1.27 makes v2 the implementation behind encoding/json while deliberately keeping v1's semantics, so the permissive behaviour is not going away on its own and waiting for it would have been waiting for nothing. RejectDuplicateKeys is the exported entry point.
Types ¶
This section is empty.
Source Files