Skip to content

Commit fd646cf

Browse files
fix: tweak rule output
1 parent 10ea194 commit fd646cf

File tree

1 file changed

+7
-12
lines changed

1 file changed

+7
-12
lines changed

website/catalog/go/unmarshal-tag-is-dash.md

Lines changed: 7 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,6 @@ According to the [Go documentation](https://pkg.go.dev/encoding/json#Marshal), i
1010

1111
This creates a security issue where developers think they are preventing a field from being unmarshaled (like `IsAdmin` in authentication), but attackers can still set that field by providing the `-` key in JSON input.
1212

13-
### Example of the vulnerability
14-
1513
```go
1614
type User struct {
1715
Username string `json:"username,omitempty"`
@@ -21,6 +19,7 @@ type User struct {
2119

2220
// This still works and sets IsAdmin to true!
2321
json.Unmarshal([]byte(`{"-": true}`), &user)
22+
// Result: main.User{Username:"", Password:"", IsAdmin:true}
2423
```
2524

2625
### YAML
@@ -35,34 +34,30 @@ rule:
3534
inside:
3635
kind: field_declaration
3736
constraints:
38-
TAG:
37+
TAG:
3938
regex: json:"-,.*"
4039
```
4140
4241
### Example
4342
4443
<!-- highlight matched code in curly-brace {lineNum} -->
45-
```go{5,10,15,20}
44+
```go{10,15,20}
4645
package main
4746

4847
type TestStruct1 struct {
49-
// ok: unmarshal-tag-is-dash
50-
A string `json:"id"`
48+
A string `json:"id"` // ok
5149
}
5250

5351
type TestStruct2 struct {
54-
// ruleid: unmarshal-tag-is-dash
55-
B string `json:"-,omitempty"`
52+
B string `json:"-,omitempty"` // wrong
5653
}
5754

5855
type TestStruct3 struct {
59-
// ruleid: unmarshal-tag-is-dash
60-
C string `json:"-,123"`
56+
C string `json:"-,123"` // wrong
6157
}
6258

6359
type TestStruct4 struct {
64-
// ruleid: unmarshal-tag-is-dash
65-
D string `json:"-,"`
60+
D string `json:"-,"` // wrong
6661
}
6762
```
6863

0 commit comments

Comments
 (0)