frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

Open in hackernews

Unexpected security footguns in Go's parsers

https://blog.trailofbits.com/2025/06/17/unexpected-security-footguns-in-gos-parsers/
73•ingve•3d ago

Comments

anitil•1d ago
This was all very interesting, but that polyglot json/yaml/xml payload was a big surprise to me! I had no idea that go's default xml parser would accept proceeding and trailing garbage. I'd always thought of json as one of the simpler formats to parse, but I suppose the real world would beg to differ.

It's interesting that decisions made about seemingly-innocuous conditions like 'what if there are duplicate keys' have a long tail of consequences

neuroelectron•4h ago
Been seeing these same problems in services for decades now. It's almost like they made these protocol languages exploitable on purpose.
v5v3•2h ago
Indeed...
e_y_•3h ago
As someone who isn't a Go programmer, on the face of it using strings (struct tags) for field metadata seems pretty backwards compared to Rust macros (which parses the metadata at compile time) or Java annotations (which are processed at runtime but at least don't require parsing a string to break apart options).

The accidental omitempty and - are a good example of the weirdness even if they might not cause problems in practice.

kjksf•2h ago
For some it's stupidity. For others it's brilliance.

It's one of many examples of 80/20 design in Go: 80% of functionality with 20% of complexity and cost.

Struct tags address an important scenario in an easy to use way.

But they don't try to address other scenarios, like annotations do. They are not function tags. They're not variable tags. They are not general purpose annotations. They are annotations for struct fields and struct fields only.

Are they are as powerful as annotations or macros? Of course not, not even close.

Are they as complex to implement, understand, use? Also not.

80/20 design. 80% of functionality at 20% of cost.

Philpax•2m ago
Go's simplifications often introduce complexities elsewhere, however, as this article demonstrates with the complexities of correctness of a stringly-typed DSL.

There's no free lunch here, and the compromises Go makes to achieve its outcomes have shown themselves to be error-prone in ways that were entirely predictable at design time.

reactordev•1h ago
struct tags greatly reduce the boilerplate code required to map fields to fields. It’s really quite novel once you understand it.
masklinn•1h ago
> struct tags greatly reduce the boilerplate code required to map fields to fields.

Are you somehow under the impression that Go is unique in having a terse way to map fields to fields?

> It’s really quite novel once you understand it.

It's the opposite of novel, putting ad-hoc annotations in unstructured contexts is what people used to do before java 5.

jlouis•34m ago
It's not very novel. There's far better ways of solving this than allowing a random string to be embedded as aux information to a struct field. Examples: F# type providers, or OCamls PPX system for extending the language in a well defined way. Macro rewriting systems also allow for better safety in this area.

This allows you to derive a safe parser from the structural data, and you can make said parser be really strict. See e.g., Wuffs or Langsec for examples of approaches here.

xnorswap•22m ago
As a .net programmer, the "stringly typed" nature of the metadata horrifies me, but the choices of Go have long confused me.

So in .NET, like Java as you mention, we have attributes, .

e.g.

    [JsonPropertyName("username")]
    [JsonIgnore]
etc.

This is simple, and obvious. The JsonPropertyName attribute is an override, you can set naming policies for the whole class. camelCase by default, with kebab-case, snake_case etc as alternative defaults.

C#/.NET of course has the benefit of having public properties, which are serialised by default, and private properties, which aren't, so you're unlikely to be exposing things you don't want to expose.

This contrasts to Go's approach, much like python, of using casing convention to determine private vs public fields. ( Please correct me if I'm wrong on this? )

The first example still confuses me though, because either you want IsAdmin to come from the user, in which case you still want to deserialise it, or you don't, in which case it shouldn't even be in your DTO at all.

Deserialisation there is a bit of a red-herring, as there should be a validation step which includes, "Does this user have the rights to create an admin?".

The idea of having a user class, which gets directly updated using properties straight from deserialized user input, feels weird to me, but I'd probably be dismissed as an "enterprise programmer" who wants to put layers between everything.

grey-area•19s ago
Not just weird, it’s dangerous to do this - to easy to miss validation as fields are added over time. Better to explicitly validate all fields IMO.
grey-area•6m ago
Yes they are a horrible idea for many reasons, not just security. It’s like a hidden ill-defined poorly understood dsl in strings.

You can just not use them though - you can unmarshal to a map instead and select the keys you want, perform validation etc and then set the values.

Same when publishing - I prefer to have an explicit view which defines the keys exposed rather than than publishing all by default based on these poorly understood string keys attached to types.

octo888•1h ago
What is "IsAdmin" doing in the "create user" request DTO in the first place? The examples seem to indicate inappropriate re-use of data models.

Would it not be better to:

  type CreateUserRequest struct {
    Username string
    Password string
  }

  type UserView struct {
    Username string
    IsAdmin boolean
  }
etc?

No need to just have just 1 model that maps 1:1 to your DB row. This applies to all languages

delusional•1h ago
> No need to just have just 1 model that maps 1:1 to your DB row. This applies to all languages

One reason is to avoid copying data constantly. I don't just mean this from an efficiency perspective, but also (and maybe more so) from a simplicity one. If you have a library for shoving data into a struct mechanistically, but you then take the data from that struct and shove it into an additional struct, what's the point of the library? You're writing the code move the data anyway.

In my dayjob I see this tendency constantly to have a lot of different very narrow structs that somehow integrate into some library, and then a TON of supporting code to copy between those structs. Only to then do very little actually useful work with any of the data at the end. I generally think you'd be happier with fatter structs that integrated less with weird "struct-filling" libraries.

masklinn•1h ago
> In my dayjob I see this tendency constantly to have a lot of different very narrow structs that somehow integrate into some library, and then a TON of supporting code to copy between those structs.

Maybe that's the problem to solve, rather than exposing the entire internal world to the outside? Because different views of the same entities is pretty critical otherwise it's way too easy to start e.g. returning PII to public endpoints because some internal process needed it.

TeMPOraL•1m ago
> also (and maybe more so) from a simplicity one. If you have a library for shoving data into a struct mechanistically, but you then take the data from that struct and shove it into an additional struct, what's the point of the library? You're writing the code move the data anyway.

Super annoying if you need to do it by hand, and wastes compute and memory if you actually need to do copies of copies, but this is the mapping part of "object relational mapping", the M in ORM. Skipping it is a bad idea.

Your business/domain model should not be tied directly to your persistence model. It's a common mistake that's responsible for like half of the bad rep ORMs get. Data structures may look superficially similar, but they represent different concepts with different semantics and expectations. If you skip on that, you'll end up with tons of stupid mistakes like 'masklinn mentions, and more subtle bugs when the concepts being squashed together start pulling in opposite directions over time.

Scaling our observability platform by embracing wide events and replacing OTel

https://clickhouse.com/blog/scaling-observability-beyond-100pb-wide-events-replacing-otel
55•valyala•3h ago•24 comments

Cosmoe: BeOS Class Library on Top of Wayland

https://cosmoe.org/index.html
47•Bogdanp•3h ago•9 comments

Samsung embeds IronSource spyware app on phones across WANA

https://smex.org/open-letter-to-samsung-end-forced-israeli-app-installations-in-the-wana-region/
448•the-anarchist•9h ago•276 comments

Life as Slime

https://www.asimov.press/p/slime
8•surprisetalk•3d ago•0 comments

Unexpected security footguns in Go's parsers

https://blog.trailofbits.com/2025/06/17/unexpected-security-footguns-in-gos-parsers/
73•ingve•3d ago•16 comments

AbsenceBench: Language models can't tell what's missing

https://arxiv.org/abs/2506.11440
251•JnBrymn•14h ago•55 comments

Phoenix.new – Remote AI Runtime for Phoenix

https://fly.io/blog/phoenix-new-the-remote-ai-runtime/
481•wut42•21h ago•210 comments

Delta Chat is a decentralized and secure messenger app

https://delta.chat/en/
49•Bluestein•6h ago•10 comments

Harper – an open-source alternative to Grammarly

https://writewithharper.com
375•ReadCarlBarks•16h ago•99 comments

Captain Cook's missing ship found after sinking 250 years ago

https://www.independent.co.uk/news/science/captain-cook-missing-ship-found-hms-endeavour-b2771322.html
9•rmason•3d ago•2 comments

YouTube's new anti-adblock measures

https://iter.ca/post/yt-adblock/
582•smitop•19h ago•876 comments

Show HN: A color name API that maps hex to the closest human-readable name

https://meodai.github.io/color-name-api/
46•meodai•2d ago•22 comments

Show HN: We moved from AWS to Hetzner, saved 90%, kept ISO 27001 with Ansible

https://medium.com/@accounts_73078/goodbye-aws-how-we-kept-iso-27001-slashed-costs-by-90-914ccb4b89fc
107•sksjvsla•3h ago•51 comments

Mathematicians hunting prime numbers discover infinite new pattern

https://www.scientificamerican.com/article/mathematicians-hunting-prime-numbers-discover-infinite-new-pattern-for/
76•georgecmu•2d ago•25 comments

A new blood type discovered in France: "Gwada negative", a global exception

https://entrevue.fr/en/un-groupe-sanguin-inedit-decouvert-en-france-gwada-negatif-une-exception-mondiale/
22•spidersouris•4h ago•10 comments

Learn You Galois Fields for Great Good (00)

https://xorvoid.com/galois_fields_for_great_good_00.html
83•signa11•12h ago•15 comments

Augmented Vertex Block Descent (AVBD)

https://graphics.cs.utah.edu/research/projects/avbd/
35•bobajeff•8h ago•3 comments

Chromium Switching from Ninja to Siso

https://groups.google.com/a/chromium.org/g/chromium-dev/c/v-WOvWUtOpg
77•hortense•3d ago•41 comments

Tiny Undervalued Hardware Companions (2024)

https://vermaden.wordpress.com/2024/03/21/tiny-undervalued-hardware-companions/
81•zdw•10h ago•16 comments

Visualizing environmental costs of war in Hayao Miyazaki's Nausicaä

https://jgeekstudies.org/2025/06/20/wilted-lands-and-wounded-worlds-visualizing-environmental-costs-of-war-in-hayao-miyazakis-nausicaa-of-the-valley-of-the-wind/
223•zdw•21h ago•63 comments

On memes, mimetic desire, and why it's always that deep

https://caitlynclark.substack.com/p/deeping-it-manifesto
16•lawrenceyan•1d ago•6 comments

Wiki Radio: The thrilling sound of random Wikipedia

https://www.monkeon.co.uk/wikiradio/
116•if-curious•15h ago•26 comments

Show HN: Nxtscape – an open-source agentic browser

https://github.com/nxtscape/nxtscape
263•felarof•19h ago•168 comments

Plastic bag bans and fees reduce harmful bag litter on shorelines

https://www.science.org/doi/10.1126/science.adp9274
76•miles•12h ago•46 comments

AMD's Freshly-Baked MI350: An Interview with the Chief Architect

https://chipsandcheese.com/p/amds-freshly-baked-mi350-an-interview
103•pella•15h ago•56 comments

College baseball, venture capital, and the long maybe

https://bcantrill.dtrace.org/2025/06/15/college-baseball-venture-capital-and-the-long-maybe/
161•bcantrill•4d ago•110 comments

Agentic Misalignment: How LLMs could be insider threats

https://www.anthropic.com/research/agentic-misalignment
57•helloplanets•4h ago•52 comments

Alpha Centauri

https://www.filfre.net/2025/06/alpha-centauri/
164•doppp•19h ago•53 comments

Oklo, the Earth's Two-billion-year-old only Known Natural Nuclear Reactor (2018)

https://www.iaea.org/newscenter/news/meet-oklo-the-earths-two-billion-year-old-only-known-natural-nuclear-reactor
187•keepamovin•1d ago•103 comments

Sega mistakenly reveals sales numbers of popular games

https://www.gematsu.com/2025/06/sega-mistakenly-reveals-sales-numbers-for-like-a-dragon-infinite-wealth-persona-3-reload-shin-megami-tensei-v-and-more
132•kelt•6h ago•92 comments