Assumption of JSON Fields from Untrusted Input (GSR-15)

[danforbes]

Websocket RPC messages are unmarshalled from JSON into a map, which should have certain fields.

If the expected fields are not present then nil will be returned. This may lead to unexpected nil pointer exceptions being raised when these pointers are used.

The issue may be resolved by first ensuring each of the required fields are present in the map before accessing them.

var reqid float64
if val, ok := msg["id"]; ok {
	if reqid, ok := val.(float64); !ok {
		// handle error
		return
	}
} else {
	// handle error
	return
}
var method string
if val, ok := msg["method"]; ok {
	if method, ok := val.(string); !ok {
		// handle error
		return
	}
} else {
	// handle error
	return
}