Find a replacement for JSON library #1219

New issue

Open

opened 2025-12-28 17:15:40 +00:00 by sami · 2 comments

sami commented

2025-12-28 17:15:40 +00:00

Owner

Originally created by @AnnaShaleva on GitHub (Nov 23, 2023).

Currently it's possible to perform DOS to RPC server using RPC requests with high depth. NeoC# doesn't have such problem since https://github.com/neo-project/neo/pull/2912 and https://github.com/neo-project/neo-modules/pull/827. However, for us it's not that easy because neither standard JSON nor ordered JSON supports nested JSON depth restriction. But this limit is restricted by default by 10000, see https://github.com/golang/go/issues/31789 and golang/go@84afaa9e94.

Describe the solution you'd like

We need to find some other JSON library that allows to restrict maximum allowed JSON depth. Ref. https://github.com/nspcc-dev/neo-go/pull/3221#discussion_r1403335833.

Originally created by @AnnaShaleva on GitHub (Nov 23, 2023). ## Is your feature request related to a problem? Please describe. Currently it's possible to perform DOS to RPC server using RPC requests with high depth. NeoC# doesn't have such problem since https://github.com/neo-project/neo/pull/2912 and https://github.com/neo-project/neo-modules/pull/827. However, for us it's not that easy because neither standard JSON nor ordered JSON supports nested JSON depth restriction. But this limit is restricted by default by 10000, see https://github.com/golang/go/issues/31789 and https://github.com/golang/go/commit/84afaa9e9491d76ea43d7125b336030a0a2a902d. ## Describe the solution you'd like We need to find some other JSON library that allows to restrict maximum allowed JSON depth. Ref. https://github.com/nspcc-dev/neo-go/pull/3221#discussion_r1403335833.

sami added the

help wanted

enhancement

dependencies

labels

2025-12-28 17:15:40 +00:00

sami commented

2025-12-28 17:15:40 +00:00

Author

Owner

@roman-khimov commented on GitHub (Nov 23, 2023):

The other way to handle it is just to try what amount of badness can we fit into 5M and how bad is it for the node. Maybe it's not that bad. But 5M is not a small number either, a lot of braces of various kinds can be put into this volume.

@roman-khimov commented on GitHub (Nov 23, 2023): The other way to handle it is just to try what amount of badness can we fit into 5M and how bad is it for the node. Maybe it's not _that_ bad. But 5M is not a small number either, a lot of braces of various kinds can be put into this volume.

sami commented

2025-12-28 17:15:40 +00:00

Author

Owner

@roman-khimov commented on GitHub (Aug 13, 2025):

https://go.dev/doc/go1.25#json_v2 should solve most problems.

@roman-khimov commented on GitHub (Aug 13, 2025): https://go.dev/doc/go1.25#json_v2 should solve most problems.