5 ms·
Exactly. Another example is python's standard library json parser that is documented to throw a JSONDecodeError on invalid input. But if the invalid json contai
by lovasoa 7y ago
Exactly.
Another example is python's standard library json parser that is documented to throw a JSONDecodeError on invalid input. But if the invalid json contains deeply nested structures, it raises a RecursionError, and this is not documented anywhere. It's easy to imagine how a code that only catches JSONDecodeError while decoding untrusted inputs could be exploited by an attacker.
- anoncake 7y agoDocumented or not, you shouldn't rely on the lib only throwing JSONDecodeError in security-critical code.
- Spivak 7y agoBut what can you do instead? It’s a really hard problem to validate generic JSON without accidentally parsing it.
- zeroimpl 7y agoValidation better be done by the parser. Otherwise, subtle differences between the validator and the parser can lead to security flaws. Your solution is to make sure you use a good parser.
- Spivak 7y agoUgh Python exceptions are always a source of anxiety for me. Without combing through the source and locking yourself to specific versions it’s nigh impossible to be sure you’ve caught everything without a “catch everything” block.