Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Find a replacement for JSON library #3226

Open
AnnaShaleva opened this issue Nov 23, 2023 · 1 comment
Open

Find a replacement for JSON library #3226

AnnaShaleva opened this issue Nov 23, 2023 · 1 comment
Labels
dependencies Dealing with project dependencies enhancement Improving existing functionality go Go language related help wanted Extra attention is needed I4 No visible changes S2 Regular significance U4 Nothing urgent

Comments

@AnnaShaleva
Copy link
Member

Is your feature request related to a problem? Please describe.

Currently it's possible to perform DOS to RPC server using RPC requests with high depth. NeoC# doesn't have such problem since neo-project/neo#2912 and neo-project/neo-modules#827. However, for us it's not that easy because neither standard JSON nor ordered JSON supports nested JSON depth restriction. But this limit is restricted by default by 10000, see golang/go#31789 and golang/go@84afaa9.

Describe the solution you'd like

We need to find some other JSON library that allows to restrict maximum allowed JSON depth. Ref. #3221 (comment).
@AnnaShaleva AnnaShaleva added help wanted Extra attention is needed go Go language related enhancement Improving existing functionality labels Nov 23, 2023
@AnnaShaleva AnnaShaleva mentioned this issue Nov 23, 2023
Merged
@roman-khimov
Copy link
Member

The other way to handle it is just to try what amount of badness can we fit into 5M and how bad is it for the node. Maybe it's not that bad. But 5M is not a small number either, a lot of braces of various kinds can be put into this volume.

@roman-khimov roman-khimov added U4 Nothing urgent dependencies Dealing with project dependencies S2 Regular significance I4 No visible changes labels Dec 21, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
dependencies Dealing with project dependencies enhancement Improving existing functionality go Go language related help wanted Extra attention is needed I4 No visible changes S2 Regular significance U4 Nothing urgent
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@roman-khimov @AnnaShaleva