Update README for error handling of CBOR extraneous data #426
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Update CBOR Quick Start to mention CBOR settings can be used for trade-offs between speed, security, encoding size, etc. Update "Quick Start" to mention new functions in v2.5.0 that return remaining bytes (extraneous data): - UnmarshalFirst() - DiagnoseFirst() Update "Status" to more explicitly mention changes should be reviewed before upgrading from v2.4 (or older) to v2.5.0 due to error handling bug fixes related to extraneous data, etc.
|
@x448 Please take a look (not urgent). Thanks! |
x448
approved these changes
Sep 2, 2023
There was a problem hiding this comment.
LGTM!
Unrelated improvement in CBOR Security: copy some of the hidden text from Highlights to make it visible under CBOR Security.
Decoder has configurable limits that defend against malicious inputs. Duplicate map key detection is supported. By contrast,
encoding/gobis not designed to be hardened against adversarial inputs.
Try shortening and adding "..." to the click-to-expand summary text and see if you like it better.
CBOR decoder has configurable limits and option to detect duplicate map keys while encoding/gob is not designed to be hardened against adversarial inputs.
x448
approved these changes
Sep 2, 2023
fxamacker
deleted the
fxamacker/update-readme-for-cbor-extraneous-data
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Changes:
CBOR Security: mention
encoding/gobis not designed to be hardened against adversarial inputsQuick Start: mention CBOR settings allow trade-offs between speed, security, encoding size, etc.
Quick Start: mention new funcs in v2.5.0 can return remaining bytes after decoding first CBOR data item:
Unmarshal, etc.I try to avoid changing default behavior of CBOR codec, but PR #380 for
Unmarshalwas a bug fix rather than new opt-in setting for reasons mentioned in that PR.How to handle extraneous data as non-error in v2.5.0
Use
UnmarshalFirstorDecoder.Decodeto handle extraneous data in CBOR as non-error.