Closed peterbourgon closed 1 year ago
https://go.dev/play/p/yBrTPLzHQWN
If you designate a payload as JSON, then step 2 is perfectly valid, and can occur anywhere between sender and receiver.
edit: I'm not trying to be argumentative, or anything like that. I'm only trying to point out an invalid assumption in the project. At this point I think I've done about as much as I can do to point out the issue, so I'll bow out, do with my comments what you will.
Coze signs strings. That string has an invalid signature and that example is working as specified. It's doing exactly what it should do.
What invalid assumption? That Coze signs and verifies strings?
What invalid assumption? That Coze signs and verifies strings?
No, that JSON serialization (as defined by the spec) produces "strings" (byte sequences) that can be signed/verified in the first place.
edit: You seem to be assuming that the specific bytes that MarshalJSON produces will not be modified between sender and receiver. That's simply not true, as a statement of fact, and regardless if those bytes are encoded as UTF-8 or otherwise.
indexCounter is accessed without synchronization, which produces data races that violate the memory model. As a proof of concept, build and run the following program with the
-race
flag.You'll see output like the following.