Re: [Json] Go JSON parser ignores the case of member names

Well, there are ways to avoid it too (see below). I see it more as an
object-mapper convenience than a JSON conformance problem. I imagine object
mapping libraries in other languages have this feature too.

- Rob

Program that prints all values from example:

package main

import (
"encoding/json"
"log"
)

func main() {
b := []byte(`{"typ":"JWS","alg":"HS256","ALG":"none"}`)
m := make(map[string]string)
err := json.Unmarshal(b, &m)
if err != nil {
log.Fatal("JSON parsing failed")
}
for k, v := range m {
println("k:", k, "v:", v)
}
}

---

k: typ v: JWS
k: alg v: HS256
k: ALG v: none

On Tue, Mar 8, 2016 at 5:20 PM, John Cowan <cowan@mercury.ccil.org> wrote:

> Manger, James scripsit:
>
> > I noticed that the default JSON parsing in the Go language
> > basically ignores the case of member names. Do JSON experts see this
> > case-insensitive parsing as a useful convenience for programmers (being
> > lenient with what you receive), or as a bad insecure design choice?
>
> I see it as Very Bad Indeed.  It violates the RFC and, as you say, causes
> a JSON text to be interpreted one way by one recipient and another way
> by another.
>
> > This looks quite diabolical for security as it is trivial to create
> > valid JSON values that will be interpreted differently by different
> > implementations. I would expect most implementations (that are expecting
> > an "alg" member) to see its "HS256" value and simply ignore the extra
> > "ALG" member.
>
> The Right Thing is to _validate your JSON_.  Make sure what you expect
> is there *before* acting on it, and if not *don't act on it*.
>
> --
> John Cowan          http://www.ccil.org/~cowan        cowan@ccil.org
> My confusion is rapidly waxing
> For XML Schema's too taxing:
> I'd use DTDs / If they had local trees --
> I think I best switch to RELAX NG.
>
> _______________________________________________
> json mailing list
> json@ietf.org
> https://www.ietf.org/mailman/listinfo/json
>