Go Parser Security Risks: Exploiting Unexpected Behaviors in JSON, XML, and YAML

Go's JSON, XML, and YAML parsers present security risks, allowing attackers to exploit unexpected behaviors to bypass authentication, circumvent authorization, and exfiltrate sensitive data. The post details three attack scenarios: (1) (Un)marshaling unexpected data: exposing data developers intended to be private; (2) Parser differentials: discrepancies between parsers enabling bypasses; and (3) Data format confusion: exploiting cross-format payload handling. Mitigations include using `DisallowUnknownFields` and custom functions to compensate for vulnerabilities in Go's standard library. The authors provide Semgrep rules to help detect vulnerable patterns.