Too relaxed {host,security}_configuration.json parser
Created by: bjoto
Issue system-transparency#134 (closed) highlighted a much more serious issue in stboot.
The host/security json files are not strictly parsed, which can lead to unexpected behavior. The following is expected of the json files:
- All valid field has to be present in the JSON structure, i.e. no field can be left out
- No unknown fields can be present
- The fields must contain valid data
In the issue above, and incorrect field was added, which lead to that the number of required signatures were 0, instead of the expected non-zero value.
It would be nice to have a check for duplicate fields as well, e.g. if say "id" is used twice.
The *json_parser_test.go
should be updated to mirror this behavior (and test for syntax, not semantics).
Edited by Linus Nordberg