readSafeJSONBody()

[pi0]

Describe the feature

H3 v2 is removing destr support from readBody utility. This is to reduce bundle size and leverage native Response.json() of the runtime platforms when possible.

While we should ALWAYS validate user input, in certain cases, user input might cause prototype poisoning.

We can introduce new readSafeJSONBody util with destr

Additional information

• Would you be willing to help implement this feature?

[kaaax0815]

Please implement this. With a option to limit file size to avoid DoS

[itpropro]

Hey @pi0, is the impact on the bundle size really that big that is make sense to sacrifice secure JSON parsing (I would argue that destr performance impact is negligible)?