Michael Pratt, Joe Tsai, Daniel Martí, Johan Brandhorst-Satzkorn, Roger Peppe, Chris Hines, and Damien Neil introduce encoding/json/v2 and encoding/json/jsontext, now stable and generally available in Go 1.27. The updated packages bring long-awaited improvements to JSON support in Go's standard library, which has been included since well before Go 1.0. This post describes the problems with encoding/json and introduces the new packages.
The authors detail problems with the existing encoding/json package. Behavioral flaws include accepting invalid UTF-8 despite RFC 8259 requirements, allowing duplicate object member names, leaking nilness of slices and maps as JSON null, case-insensitive unmarshaling, and inconsistent calling of MarshalJSON methods on pointer receivers. Some issues, such as duplicate names, have been exploited before, including CVE-2017-12635.
API deficiencies make it difficult to unmarshal from an io.Reader. Options can be set on Encoder and Decoder types but cannot be used with Marshal and Unmarshal functions. Similarly, types implementing Marshaler and Unmarshaler interfaces cannot make use of the options. The new packages address these shortcomings after additional feedback and refinement, offering a more flexible and secure foundation for Go JSON processing.
Source: Hacker News · Summarized by HeadlinesBriefing