Re: [Json] Go JSON parser ignores the case of member names

[John Cowan <[e-mail]>]

Manger, James scripsit:

> I noticed that the default JSON parsing in the Go language
> basically ignores the case of member names. Do JSON experts see this
> case-insensitive parsing as a useful convenience for programmers (being
> lenient with what you receive), or as a bad insecure design choice?

I see it as Very Bad Indeed.  It violates the RFC and, as you say, causes
a JSON text to be interpreted one way by one recipient and another way
by another.

> This looks quite diabolical for security as it is trivial to create
> valid JSON values that will be interpreted differently by different
> implementations. I would expect most implementations (that are expecting
> an "alg" member) to see its "HS256" value and simply ignore the extra
> "ALG" member. 

The Right Thing is to _validate your JSON_.  Make sure what you expect
is there *before* acting on it, and if not *don't act on it*.

-- 
John Cowan          http://www.ccil.org/~cowan        [e-mail]
My confusion is rapidly waxing
For XML Schema's too taxing:
I'd use DTDs / If they had local trees --
I think I best switch to RELAX NG.