Usage of mailru/easyjson in parser.go

[saars-orca]

Hi,
KICS uses a library called easyjson(mailru/easyjson) which was added originally to speed up JSON parsing vs the built-in encoding/json library(as can be seen in this PR, parser.go:24) in a specific code section.

This library has not been updated for over 2 years and was listed by Kubernetes as an unwanted dependency,
another issue is that it was maintained by mail.ru which is subject to sanctions as explained here.
Finally, easyjson uses unsafe calls for unmarshaling and parsing JSONs, which could also be an issue.

There are many places in the code where KICS calls encoding/json unmarshal/marshal, but only one place where easyjson is called(with encoding/json as a fallback anyway).

Should easyjson be dropped? there are many other json marshal/unmarshal implementations out there, and can be used as drop-in replacements for encoding/json if needed if improving performance is a consideration.

[gabriel-cx]

Hi @saars-orca ,

Thank you very much for this input!
I agree with your point of view on this topic; we should replace it with a more solid and secure solution.

@nunoocx @anterosilva1985 @kaplanlior , kindly share your thoughts on the topic and lets make a plan to find the best solution for this situation.

[nunoocx]

Let's plan and go for it ASAP

[anterosilva1985]

HI @gabriel-cx ,
Let's do this asap

[gabriel-cx]

Hi @saars-orca ,

A PR was merged to fix this situation.
Thank you again for your inputs on this!