3 ms·
last key wins is terrible advice and has serious security implications. see https://bishopfox.com/blog/json-interoperability-vulnerabilities https://bishopfox.
by cowl 3y ago
last key wins is terrible advice and has serious security implications.
see https://bishopfox.com/blog/json-interoperability-vulnerabilities https://bishopfox.com/blog/json-interoperability-vulnerabili... or https://www.cvedetails.com/cve/CVE-2017-12635/ https://www.cvedetails.com/cve/CVE-2017-12635/ for concrete examples where this treatment causes security issues.
the https://datatracker.ietf.org/doc/html/rfc7493 https://datatracker.ietf.org/doc/html/rfc7493 defines a more strict format where duplicate keys are not allowed.
- kiitos 3y agoLast key wins is the most common behavior among widely-used implementations. It should be assumed as the default.