json.unmarshal unmarshals an invalid json in some cases

[katsew]

Hi, I wrote some tests in conftest, which is implemented on top of opa.
I hit an unexpected result in some cases with json.unmarshal.

Here is an example to reproduce the issue.
https://play.openpolicyagent.org/p/XS3RGihDpm

Expected Behavior

It should be panicked when invalid json is passed into json.unmarshal.

Actual Behavior

json.unmarshal succeeded.

Steps to Reproduce the Problem

1. write invalid json
2. write rule which uses json.unmarshal with input of step 1
3. execute

[patrick-east]

Looks like the problem might be with how the decoding is happening. Under the hood we are using encoding/json's decoder https://golang.org/pkg/encoding/json/#Decoder.Decode which decodes the next json encoded value.. so in the example from the playground { "k": 1 }{}} it seems like it will decode the first valid part {"k": 1} and returns it without checking anything else. A quick look at the source for Decode() seems to confirm this.