Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Poison.decode with keys: :atoms is unsafe #106

Open
jessedijkstra opened this issue Dec 14, 2018 · 0 comments
Open

Poison.decode with keys: :atoms is unsafe #106

jessedijkstra opened this issue Dec 14, 2018 · 0 comments

Comments

@jessedijkstra
Copy link

In the decodes the keys of the result are always cast to an atom. Because of the limitations on atoms and because atoms never get garbage collected this creates an attack vector for denial of service attacks since there is no way to determine the Twitter API is safe.

https://github.com/devinus/poison#parser

Since most JSON data is already parsed to structs, maybe the data should be parsed with with the as: argument which parses the data to structs through Poison.

This however does require quite an extensive refactor since parsing is most often done after decoding the data.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant