Function decodeJSON

internal/server/server.go:2344–2346

2 MiB decodeJSON reads and unmarshals the JSON body into v. Wraps the body in http.MaxBytesReader so an attacker can't exhaust memory by POSTing a multi-GB JSON blob — without this, json.NewDecoder.Decode happily streams the whole body into a single allocation.

(r *http.Request, v interface{})

// multi-GB JSON blob — without this, json.NewDecoder.Decode happily
// streams the whole body into a single allocation.
func decodeJSON(r *http.Request, v interface{}) error {
	return decodeJSONWithLimit(r, v, defaultJSONBodyLimit)
}

// decodeJSONWithLimit is the size-configurable variant. Use this for
// endpoints that accept large payloads (e.g. bulk-import) where the