For configuration files I just put in comments anyway and strip them before feeding the file to a JSON parser. (Like here: https://github.com/creshal/yspave/blo

For configuration files I just put in comments anyway and strip them before feeding the file to a JSON parser. (Like here: https://github.com/creshal/yspave/blob/master/yspave/pave.py#L33 https://github.com/creshal/yspave/blob/master/yspave/pave.py... ) Hackish, but beats having to bother with YAML parsers and their regular RCE vulnerabilities.