Protect from unsafe JSON parsing behavior. #325
Conversation
I believe the only way that this could have been exploited would be if the API used encrypted cookies and an attacker knew the encryption key.
We were already sniffing for JSON by reading the first char and matching against '{', so we wouldn't have been vulnerable to any attack in standard usage.
Codecov Report
@@ Coverage Diff @@
## master #325 +/- ##
==========================================
+ Coverage 90.01% 90.04% +0.02%
==========================================
Files 25 26 +1
Lines 1142 1145 +3
==========================================
+ Hits 1028 1031 +3
Misses 114 114
Continue to review full report at Codecov.
|
|
Oh, look at you! One step ahead of me :) Thanks |
* master: Protect from unsafe JSON parsing behavior. (rstudio#325) use `inherits(obj, "xxx")` and `expect_s3_class(obj, "xxx")` rather than "xxx" %in% class(obj) (rstudio#313) Multiline POST body collapsed (rstudio#297) Install plumber from CRAN in top level Docker file (rstudio#292)
|
I know it's late in the game (congrats on 1.0.0!), is there an advantage to using this over |
|
Line 4 in 47100cd parse_json and defaults simply to FALSE. I believe this should have the same behavior as before.
Never too late to bring up discussion and to double check things! Thank you! 😊😊 |
|
Thanks @schloerke. I have been bitten (local-code only, not within plumber) by the flexibility of But mostly ... I should have realized that even though I read the new-release |
I believe the only way that this could have been exploited would be if the API used encrypted cookies and an attacker knew the encryption key.
We were already sniffing for JSON by reading the first char and matching against '{', so we wouldn't have been vulnerable to any attack in standard usage.