3 ms·
Documented or not, you shouldn't rely on the lib only throwing JSONDecodeError in security-critical code.
by anoncake 7y ago
Documented or not, you shouldn't rely on the lib only throwing JSONDecodeError in security-critical code.
- Spivak 7y agoBut what can you do instead? It’s a really hard problem to validate generic JSON without accidentally parsing it.
- zeroimpl 7y agoValidation better be done by the parser. Otherwise, subtle differences between the validator and the parser can lead to security flaws. Your solution is to make sure you use a good parser.