Skip to content

Conversation

@vminkobin
Copy link
Contributor

json.NewEncoder adds "\n" at the end of encoded data https://github.com/golang/go/blob/26b48442569102226baba1d9b4a83aaee3d06611/src/encoding/json/stream.go#L196

This can cause potential issues when requests should be signed.
Consider this code,

req := httpClient.InitClient("https://test.com", nil)

	body := map[string]interface{}{"payload": "data"}
	bbs, _ := json.Marshal(body)
	signature, _ := crypto.HMACSHA256(bbs, "key")

	res, _ := req.
		Execute(context.Background(),
			httpClient.NewReqBuilder().
				Headers(map[string]string{
					"Signature":    string(signature),
					"Content-Type": "application/json",
				}).
				Method(http.MethodPost).
				PathStatic("/test").
				Body(body).
				Build(),
		)

the server will not get valid signature because json.Marshall will return {"payload": "data"} but request body will be {"payload": "data"}\n

… the body. This can produce issues when sending signed requests.
@vminkobin vminkobin marked this pull request as ready for review October 18, 2022 10:21
@vminkobin vminkobin requested review from DeimonDB and covain October 18, 2022 10:21
Copy link
Contributor

@DeimonDB DeimonDB left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Make sure tests still pass

Copy link
Collaborator

@covain covain left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dangerous change. Once upgrading go-libs in any repository, verify no tests are failing

Copy link

@money42002 money42002 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

client/client_execute.go

Copy link

@money42002 money42002 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

client/client_execute.go

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants