Go Parser Footguns

Overview: Think you know how Go's parsers work? Think again. This talk dives into the surprising and potentially dangerous behaviors in Go's most common parsers. Did you know that you can have an input string that successfully parses as YAML, JSON, and XML? From JSON's case-insensitive field matching to XML's garbage-tolerant parsing, we'll explore how these “features” can lead to serious security vulnerabilities. Through real-world case studies, we'll demonstrate how these parser quirks have led to authentication bypasses in production systems, how you can find similar issues, and how you c Details: an fix these issues in your own code.