Author: Gavin Andresen 2012-12-03 20:59:16
Published on: 2012-12-03T20:59:16+00:00
In an email conversation among developers, a question was raised regarding the encoding standard of JSON. Mike Koss suggested using the text representation of a (utf8) JSON instead of complex encoding standards. However, Gavin Andresen pointed out that using an envelope JSON with repeated keys can lead to undefined results when parsed by standard JSON parsers. The JOSE (Javascript Signing and Encryption) specification recommends using a JSON parser that treats multi-defined-keys as an error. Gavin Andresen expressed concern that developers may use convenient JSON parsers, despite warnings not to do so, which could lead to mismatches and create vulnerabilities for attackers to exploit.
Updated on: 2023-06-06T08:49:17.612526+00:00