logoalt Hacker News

cogman10last Friday at 11:33 PM1 replyview on HN

Other answers are good. One more that you could do is put the JSON document inside a container (A zip archive for example). Then your document can effectively be

    invoice.inv (zip archive)
    └- payload.json
    └- signature.asc
This has the benefit of adding more opportunities for many json documents within the archive.

It's effectively what the Java jar is.


Replies

bsamuelslast Saturday at 12:13 AM

dont unzip an untrusted payload

show 1 reply