Parsing JSON, despite its seemingly simple format, is actually quite challenging because there are so many specifications that can be interpreted in different ways. This has led to inconsistencies in how different JSON parsers handle edge cases, extreme values, and maliciously crafted payloads, resulting in potential bugs, crashes, and denial-of-service vulnerabilities. This article goes into detail about this issue with examples of different types of objects (arrays, objects, numbers, and strings) combined with different types of parsers (C Parsers, Regex, and more).
Tuesday, June 4, 2024