nspcc-dev/neo-go

Find a replacement for JSON library

Open

#3,226 opened on Nov 23, 2023

View on GitHubContributor guide
 (2 comments) (0 reactions) (0 assignees)Go (108 forks)auto 404
I4S2U4dependenciesenhancementgohelp wanted

Repository metrics

Stars
 (132 stars)
PR merge metrics
 (PR metrics pending)

Description

Is your feature request related to a problem? Please describe.

Currently it's possible to perform DOS to RPC server using RPC requests with high depth. NeoC# doesn't have such problem since https://github.com/neo-project/neo/pull/2912 and https://github.com/neo-project/neo-modules/pull/827. However, for us it's not that easy because neither standard JSON nor ordered JSON supports nested JSON depth restriction. But this limit is restricted by default by 10000, see https://github.com/golang/go/issues/31789 and https://github.com/golang/go/commit/84afaa9e9491d76ea43d7125b336030a0a2a902d.

Describe the solution you'd like

We need to find some other JSON library that allows to restrict maximum allowed JSON depth. Ref. https://github.com/nspcc-dev/neo-go/pull/3221#discussion_r1403335833.

Contributor guide

Research direction
Research Go JSON libraries that support maximum depth restriction, such as json iterator or a custom wrapper around standard JSON. Compare their APIs and integration steps.
Tech stack
go
Domain
backend
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
Go
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
65