2 MiB decodeJSON reads and unmarshals the JSON body into v. Wraps the body in http.MaxBytesReader so an attacker can't exhaust memory by POSTing a multi-GB JSON blob — without this, json.NewDecoder.Decode happily streams the whole body into a single allocation.
(r *http.Request, v interface{})
| 1873 | // multi-GB JSON blob — without this, json.NewDecoder.Decode happily |
| 1874 | // streams the whole body into a single allocation. |
| 1875 | func decodeJSON(r *http.Request, v interface{}) error { |
| 1876 | return decodeJSONWithLimit(r, v, defaultJSONBodyLimit) |
| 1877 | } |
| 1878 | |
| 1879 | // decodeJSONWithLimit is the size-configurable variant. Use this for |
| 1880 | // endpoints that accept large payloads (e.g. bulk-import) where the |