JsonParser Security Issue

[FearlessPixel]

https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMBUGERJSONPARSER-15674455

[thomaspoignant]

Hi,
thanks for raising this issue.
The vulnerability affects only the jsonschema generation.

github.com/buger/jsonparser is pulled in transitively by: github.com/invopop/jsonschema → github.com/wk8/go-ordered-map/v2 → github.com/buger/jsonparser

In this repo, that chain comes from cmd/jsonschema-generator.

It is not affecting the actual runtimes of GO Feature Flag.
We will still look to fix that, but this is not a major security issue for the usage of GO Feature Flag.

[thomaspoignant]

A PR is open to fix the issue on github.com/buger/jsonparser buger/jsonparser#276.
I will track it and the upgrades in the different packages before fixing it.

[buger]

Fixed in the recent patch release v1.1.2

[thomaspoignant]

@buger thanks for the patch, this is awesome.
@FearlessPixel I know follow this issue wk8/go-ordered-map#59 to be sure that the full chain is updating.