2 MiB decodeJSON reads and unmarshals the JSON body into v. Wraps the body in http.MaxBytesReader so an attacker can't exhaust memory by POSTing a multi-GB JSON blob — without this, json.NewDecoder.Decode happily streams the whole body into a single allocation.
(r *http.Request, v interface{})
| 1837 | // multi-GB JSON blob — without this, json.NewDecoder.Decode happily |
| 1838 | // streams the whole body into a single allocation. |
| 1839 | func decodeJSON(r *http.Request, v interface{}) error { |
| 1840 | return decodeJSONWithLimit(r, v, defaultJSONBodyLimit) |
| 1841 | } |
| 1842 | |
| 1843 | // decodeJSONWithLimit is the size-configurable variant. Use this for |
| 1844 | // endpoints that accept large payloads (e.g. bulk-import) where the |