nspcc-dev/neo-go

Find a replacement for JSON library

オープン

#3,226 opened on 2023/11/23

 (2 件のコメント) (0 件のリアクション) (0 人の担当者)Go (108 件のフォーク)auto 404
I4S2U4dependenciesenhancementgohelp wanted

Repository metrics

Stars
 (132 個のスター)
PR merge metrics
 (PR metrics pending)

説明

Is your feature request related to a problem? Please describe.

Currently it's possible to perform DOS to RPC server using RPC requests with high depth. NeoC# doesn't have such problem since https://github.com/neo-project/neo/pull/2912 and https://github.com/neo-project/neo-modules/pull/827. However, for us it's not that easy because neither standard JSON nor ordered JSON supports nested JSON depth restriction. But this limit is restricted by default by 10000, see https://github.com/golang/go/issues/31789 and https://github.com/golang/go/commit/84afaa9e9491d76ea43d7125b336030a0a2a902d.

Describe the solution you'd like

We need to find some other JSON library that allows to restrict maximum allowed JSON depth. Ref. https://github.com/nspcc-dev/neo-go/pull/3221#discussion_r1403335833.

コントリビューターガイド