ankuranand's comments

On: A high-performance, zero allocation, dynamic JSON ...

[ankuranand]

What is JSON Threat Protection? JSON requests are susceptible to attacks characterized by unusual inflation of elements and nesting levels. Attackers use recursive techniques to consume memory resources by using huge json files to overwhelm the parser and eventually crash the service. JSON threat protection is terms that describe the way to minimize the risk from such attacks by defining few limits on the json structure like length and depth validation on a json, and helps protect your applications from such intrusions.

There are situations where you do not want to parse the JSON, but do want to ensure that the JSON is not going to cause a problem. Such as an API Gateway. It would be a PITA for the gateway to have to know all JSON schema of all services it is protecting. There are XML validators that perform similar functions.

On: A high-performance, zero allocation, dynamic JSON ...

[ankuranand]

What is JSON Threat Protection?

JSON requests are susceptible to attacks characterized by unusual inflation of elements and nesting levels. Attackers use recursive techniques to consume memory resources by using huge json files to overwhelm the parser and eventually crash the service.

JSON threat protection is terms that describe the way to minimize the risk from such attacks by defining few limits on the json structure like length and depth validation on a json, and helps protect your applications from such intrusions.

On: A high-performance, zero allocation, dynamic JSON ...

[ankuranand]

There is `func (v Verify) Verify(reader io.Reader) (bool, error)` function in the api, which will support the streaming part. Currently it's WIP.

On: A high-performance, zero allocation, dynamic JSON ...

[ankuranand]

JavaScript object notation(JSON) is vulnerable to content level attacks. Such attacks attempt to use huge json files to overwhelm the parser and eventually crash the service.

JSON threat protection is terms that describe the way to minimize the risk from such attacks by defining few limits on the json structure.

Yes It also validates the json.

[zemnmez → ankuranand]

if the idea is "limit the size of JSON" you already have http.MaxBytesReader or io.LimitReader

On: A high-performance, zero allocation, dynamic JSON ...

[ankuranand]

JavaScript object notation(JSON) is vulnerable to content level attacks. Such attacks attempt to use huge json files to overwhelm the parser and eventually crash the service.

JSON threat protection is terms that describe the way to minimize the risk from such attacks by defining few limits on the json structure.

[hartator → ankuranand]

I see. Is that really useful? Worst case is a 500?

[winrid → hartator]

It validates the structure before fully parsing it and allocating lots of objects you normally wouldn't.

On: A high-performance, zero allocation, dynamic JSON ...

[ankuranand]

Thanks for feedback, while "JSON Threat Protection" is also a quite used terminology, but yes would provide an description with common word too. Currently Streaming handling is in progress.

On: Build Your Own Text Editor

[ankuranand]

shameless Plug: I'm working on writing this in Go(Golang). https://github.com/ankur-anand/goditor

[japanoise → ankuranand]

Even more shameless: I used it as a base for my own ersatz-emacs in golang! https://github.com/japanoise/gomacs

This is actually my go-to editor for small files/quick edits now

[dualogy → ankuranand]

Good stuff for reminding me that `x/sys/unix` exists and the terminal-raw-mode it allows. Should inspire someone out there eventually to plumb everything in pure Go that people would otherwise seek from ncurses, GNU readline lib etc.

[_ph_ → ankuranand]

You should attach a license to your code.