jsonmapper icon indicating copy to clipboard operation
jsonmapper copied to clipboard

Document that JsonMapper is not designed for input validation

Open dktapps opened this issue 1 year ago • 0 comments

If JsonMapper can't be relied on for JSON validation during mapping, it should be clearly documented so that no one tries to rely on the library for data validation. All of the security issues coming from PocketMine-MP arose because of validation loopholes in JsonMapper that I didn't expect.

FWIW, other libraries like Valinor do perform full validation, so I don't think it's unreasonable to assume that complete validation would be a part of a library like this.

Related to: https://github.com/cweiske/jsonmapper/issues/226#issuecomment-1954588493

dktapps avatar May 13 '24 09:05 dktapps