chore: remove direct json-iterator dependency (#1386)

* added eviction strategy

* added tests for eviction strategy

* Revert "feat(server) added eviction strategy"

* chore(deps): bump github.com/refraction-networking/utls

Bumps [github.com/refraction-networking/utls](https://github.com/refraction-networking/utls) from 1.8.0 to 1.8.2.
- [Release notes](https://github.com/refraction-networking/utls/releases)
- [Commits](refraction-networking/utls@v1.8.0...v1.8.2)

---
updated-dependencies:
- dependency-name: github.com/refraction-networking/utls
  dependency-version: 1.8.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix: return 252 for SMTP VRFY instead of 502 (fixes #991)

The smtpd library hard-codes '502 Command not implemented' for VRFY.
Per RFC 5321 §3.5.1, a server that cannot verify a mailbox SHOULD
return 252 ('Cannot VRFY user, but will accept message and attempt
delivery') instead.

Returning 502 causes clients such as curl to abort the session before
issuing the DATA command, resulting in emails being silently dropped.

Fix: point git.mills.io/prologic/smtpd at a patched fork via a
go.mod replace directive. The fork is a minimal, single-commit patch
on top of the upstream smtpd commit that changes only the VRFY case.

* chore: replace direct json-iterator usage with encoding/json

Migrates all direct uses of github.com/json-iterator/go in non-test
and test files to encoding/json, making json-iterator indirect-only
(it remains transitively via an upstream dep).

This is part of the projectdiscovery/nuclei#7458 dependency-reduction
effort: nuclei's PR #7457 already removed json-iterator from nuclei's
direct deps, but json-iterator remained a direct dep of interactsh
(exposed through pkg/client.Client), which kept it in nuclei's
indirect dep tree.

Files changed:
- cmd/interactsh-client/main.go
- pkg/client/client.go            (also converts UnmarshalFromString → json.Unmarshal([]byte(...)))
- pkg/server/{dns,ftp,http,ldap,responder,smb,smtp}_server.go
- pkg/storage/roundtrip_test.go

* merge dev

* guard overflow

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Orr Kapel <orr.k@litt.security>
Co-authored-by: Mzack9999 <mzack9999@protonmail.com>
Co-authored-by: Dogan Can Bakir <65292895+dogancanbakir@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: XananasX7 <XananasX7@users.noreply.github.com>

Author: 5 people

cmd/interactsh-client/main.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"bytes"
+	"encoding/json"
 	"fmt"
 	"os"
 	"os/signal"
@@ -10,7 +11,6 @@ import (
 	"strings"
 	"time"
 
-	jsoniter "github.com/json-iterator/go"
 	asnmap "github.com/projectdiscovery/asnmap/libs"
 	"github.com/projectdiscovery/goflags"
 	"github.com/projectdiscovery/gologger"
@@ -266,7 +266,7 @@ func main() {
 				}
 			}
 		} else {
-			b, err := jsoniter.Marshal(interaction)
+			b, err := json.Marshal(interaction)
 			if err != nil {
 				gologger.Error().Msgf("Could not marshal json output: %s\n", err)
 			} else {

go.mod

@@ -9,7 +9,6 @@ require (
 	github.com/docker/go-units v0.5.0
 	github.com/goburrow/cache v0.1.4
 	github.com/google/uuid v1.6.0
-	github.com/json-iterator/go v1.1.12
 	github.com/libdns/libdns v1.1.1
 	github.com/mackerelio/go-osstat v0.2.6
 	github.com/miekg/dns v1.1.68
@@ -87,6 +86,7 @@ require (
 	github.com/jcmturner/goidentity/v6 v6.0.1 // indirect
 	github.com/jcmturner/gokrb5/v8 v8.4.4 // indirect
 	github.com/jcmturner/rpc/v2 v2.0.3 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/compress v1.18.2 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect

pkg/client/client.go

@@ -10,7 +10,9 @@ import (
 	"crypto/sha256"
 	"crypto/x509"
 	"encoding/base64"
+	"encoding/json"
 	"encoding/pem"
+	"errors"
 	"fmt"
 	"io"
 	"net"
@@ -22,10 +24,7 @@ import (
 	"sync/atomic"
 	"time"
 
-	"errors"
-
 	"github.com/google/uuid"
-	jsoniter "github.com/json-iterator/go"
 	asnmap "github.com/projectdiscovery/asnmap/libs"
 	"github.com/projectdiscovery/gologger"
 	"github.com/projectdiscovery/interactsh/pkg/options"
@@ -270,7 +269,7 @@ func encodeRegistrationRequest(publicKey, secretkey, correlationID string) ([]by
 		CorrelationID: correlationID,
 	}
 
-	data, err := jsoniter.Marshal(register)
+	data, err := json.Marshal(register)
 	if err != nil {
 		return nil, errkit.Wrap(err, "could not marshal register request")
 	}
@@ -457,7 +456,7 @@ func (c *Client) getInteractions(callback InteractionCallback) error {
 		return fmt.Errorf("could not poll interactions: %s", string(data))
 	}
 	response := &server.PollResponse{}
-	if err := jsoniter.NewDecoder(resp.Body).Decode(response); err != nil {
+	if err := json.NewDecoder(resp.Body).Decode(response); err != nil {
 		gologger.Error().Msgf("Could not decode interactions: %v\n", err)
 		return err
 	}
@@ -470,7 +469,7 @@ func (c *Client) getInteractions(callback InteractionCallback) error {
 		}
 		plaintext = bytes.TrimRight(plaintext, " \t\r\n")
 		interaction := &server.Interaction{}
-		if err := jsoniter.Unmarshal(plaintext, interaction); err != nil {
+		if err := json.Unmarshal(plaintext, interaction); err != nil {
 			gologger.Error().Msgf("Could not unmarshal interaction data interaction: %v\n", err)
 			continue
 		}
@@ -479,7 +478,7 @@ func (c *Client) getInteractions(callback InteractionCallback) error {
 
 	for _, plaintext := range response.Extra {
 		interaction := &server.Interaction{}
-		if err := jsoniter.UnmarshalFromString(plaintext, interaction); err != nil {
+		if err := json.Unmarshal([]byte(plaintext), interaction); err != nil {
 			gologger.Error().Msgf("Could not unmarshal interaction data interaction: %v\n", err)
 			continue
 		}
@@ -492,7 +491,7 @@ func (c *Client) getInteractions(callback InteractionCallback) error {
 			continue
 		}
 		interaction := &server.Interaction{}
-		if err := jsoniter.UnmarshalFromString(data, interaction); err != nil {
+		if err := json.Unmarshal([]byte(data), interaction); err != nil {
 			gologger.Error().Msgf("Could not unmarshal interaction data interaction: %v\n", err)
 			continue
 		}
@@ -564,7 +563,7 @@ func (c *Client) Close() error {
 		CorrelationID: c.correlationID,
 		SecretKey:     c.secretKey,
 	}
-	data, err := jsoniter.Marshal(register)
+	data, err := json.Marshal(register)
 	if err != nil {
 		return errkit.Wrap(err, "could not marshal deregister request")
 	}
@@ -634,7 +633,7 @@ func (c *Client) performRegistration(serverURL string, payload []byte) error {
 		return fmt.Errorf("could not register to server: %s", string(data))
 	}
 	response := make(map[string]interface{})
-	if err := jsoniter.NewDecoder(resp.Body).Decode(&response); err != nil {
+	if err := json.NewDecoder(resp.Body).Decode(&response); err != nil {
 		return errkit.Wrap(err, "could not register to server")
 	}
 	message, ok := response["message"]

pkg/server/ftp_server.go

@@ -9,7 +9,7 @@ import (
 	"sync/atomic"
 	"time"
 
-	jsoniter "github.com/json-iterator/go"
+	"encoding/json"
 	"github.com/projectdiscovery/gologger"
 	ftpserver "goftp.io/server/v2"
 	"goftp.io/server/v2/driver/file"
@@ -130,7 +130,7 @@ func (h *FTPServer) recordInteraction(remoteAddress, data string) {
 		RawRequest:    data,
 		Timestamp:     time.Now(),
 	}
-	dataBytes, err := jsoniter.Marshal(interaction)
+	dataBytes, err := json.Marshal(interaction)
 	if err != nil {
 		gologger.Warning().Msgf("Could not encode ftp interaction: %s\n", err)
 	} else {

pkg/server/http_server.go

@@ -3,6 +3,7 @@ package server
 import (
 	"crypto/tls"
 	"encoding/base64"
+	"encoding/json"
 	"fmt"
 	"log"
 	"net"
@@ -16,7 +17,6 @@ import (
 	"sync/atomic"
 	"time"
 
-	jsoniter "github.com/json-iterator/go"
 	"github.com/projectdiscovery/gologger"
 	stringsutil "github.com/projectdiscovery/utils/strings"
 )
@@ -157,7 +157,7 @@ func (h *HTTPServer) logger(handler http.Handler) http.HandlerFunc {
 						RemoteAddress: host,
 						Timestamp:     time.Now(),
 					}
-					data, err := jsoniter.Marshal(interaction)
+					data, err := json.Marshal(interaction)
 					if err != nil {
 						gologger.Warning().Msgf("Could not encode root tld http interaction: %s\n", err)
 					} else {
@@ -217,7 +217,7 @@ func (h *HTTPServer) handleInteraction(r *http.Request, uniqueID, fullID, reqStr
 		RemoteAddress: hostPort,
 		Timestamp:     time.Now(),
 	}
-	data, err := jsoniter.Marshal(interaction)
+	data, err := json.Marshal(interaction)
 	if err != nil {
 		gologger.Warning().Msgf("Could not encode http interaction: %s\n", err)
 	} else {
@@ -382,7 +382,7 @@ type RegisterRequest struct {
 // registerHandler is a handler for client register requests
 func (h *HTTPServer) registerHandler(w http.ResponseWriter, req *http.Request) {
 	r := &RegisterRequest{}
-	if err := jsoniter.NewDecoder(req.Body).Decode(r); err != nil {
+	if err := json.NewDecoder(req.Body).Decode(r); err != nil {
 		gologger.Warning().Msgf("Could not decode json body: %s\n", err)
 		jsonError(w, fmt.Sprintf("could not decode json body: %s", err), http.StatusBadRequest)
 		return
@@ -410,7 +410,7 @@ type DeregisterRequest struct {
 // deregisterHandler is a handler for client deregister requests
 func (h *HTTPServer) deregisterHandler(w http.ResponseWriter, req *http.Request) {
 	r := &DeregisterRequest{}
-	if err := jsoniter.NewDecoder(req.Body).Decode(r); err != nil {
+	if err := json.NewDecoder(req.Body).Decode(r); err != nil {
 		gologger.Warning().Msgf("Could not decode json body: %s\n", err)
 		jsonError(w, fmt.Sprintf("could not decode json body: %s", err), http.StatusBadRequest)
 		return
@@ -476,7 +476,7 @@ func (h *HTTPServer) pollHandler(w http.ResponseWriter, req *http.Request) {
 	}
 	response := &PollResponse{Data: data, AESKey: aesKey, TLDData: tlddata, Extra: extradata}
 
-	if err := jsoniter.NewEncoder(w).Encode(response); err != nil {
+	if err := json.NewEncoder(w).Encode(response); err != nil {
 		gologger.Warning().Msgf("Could not encode interactions for %s: %s\n", ID, err)
 		jsonError(w, fmt.Sprintf("could not encode interactions: %s", err), http.StatusBadRequest)
 		return
@@ -505,7 +505,7 @@ func jsonBody(w http.ResponseWriter, key, value string, code int) {
 	w.Header().Set("Content-Type", "application/json; charset=utf-8")
 	w.Header().Set("X-Content-Type-Options", "nosniff")
 	w.WriteHeader(code)
-	_ = jsoniter.NewEncoder(w).Encode(map[string]interface{}{key: value})
+	_ = json.NewEncoder(w).Encode(map[string]interface{}{key: value})
 }
 
 func jsonError(w http.ResponseWriter, err string, code int) {
@@ -540,5 +540,5 @@ func (h *HTTPServer) metricsHandler(w http.ResponseWriter, req *http.Request) {
 
 	w.Header().Set("Content-Type", "application/json; charset=utf-8")
 	w.Header().Set("X-Content-Type-Options", "nosniff")
-	_ = jsoniter.NewEncoder(w).Encode(interactMetrics)
+	_ = json.NewEncoder(w).Encode(interactMetrics)
 }

pkg/server/http_server_test.go

@@ -7,6 +7,7 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/base64"
+	"encoding/json"
 	"encoding/pem"
 	"io"
 	"net/http"
@@ -17,7 +18,6 @@ import (
 	"time"
 
 	"github.com/google/uuid"
-	jsoniter "github.com/json-iterator/go"
 	"github.com/projectdiscovery/interactsh/pkg/storage"
 	"github.com/rs/xid"
 	"github.com/stretchr/testify/require"
@@ -117,7 +117,7 @@ func TestSessionTotalMetric(t *testing.T) {
 	secretKey := uuid.New().String()
 
 	// --- Register ---
-	regBody, err := jsoniter.Marshal(&RegisterRequest{
+	regBody, err := json.Marshal(&RegisterRequest{
 		PublicKey:     pubB64,
 		SecretKey:     secretKey,
 		CorrelationID: correlationID,
@@ -132,7 +132,7 @@ func TestSessionTotalMetric(t *testing.T) {
 	require.Equal(t, int64(1), atomic.LoadInt64(&stats.SessionsTotal), "sessions_total should be 1 after register")
 
 	// --- Deregister ---
-	deregBody, err := jsoniter.Marshal(&DeregisterRequest{
+	deregBody, err := json.Marshal(&DeregisterRequest{
 		SecretKey:     secretKey,
 		CorrelationID: correlationID,
 	})

pkg/server/ldap_server.go

@@ -7,7 +7,7 @@ import (
 	"sync/atomic"
 	"time"
 
-	jsoniter "github.com/json-iterator/go"
+	"encoding/json"
 	"github.com/projectdiscovery/gologger"
 	ldap "github.com/projectdiscovery/ldapserver"
 	stringsutil "github.com/projectdiscovery/utils/strings"
@@ -144,7 +144,7 @@ func (ldapServer *LDAPServer) handleInteraction(uniqueID, fullID, reqString, hos
 			RemoteAddress: host,
 			Timestamp:     time.Now(),
 		}
-		data, err := jsoniter.Marshal(interaction)
+		data, err := json.Marshal(interaction)
 		if err != nil {
 			gologger.Warning().Msgf("Could not encode ldap interaction: %s\n", err)
 		} else {
@@ -410,7 +410,7 @@ func (ldapServer *LDAPServer) logInteraction(interaction Interaction) {
 	// Correlation id doesn't apply here, we skip encryption
 	interaction.Protocol = "ldap"
 	interaction.Timestamp = time.Now()
-	data, err := jsoniter.Marshal(interaction)
+	data, err := json.Marshal(interaction)
 	if err != nil {
 		gologger.Warning().Msgf("Could not encode ldap interaction: %s\n", err)
 	} else {

pkg/server/ntlm_capture.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/binary"
 	"encoding/hex"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"sync/atomic"
@@ -12,7 +13,6 @@ import (
 	"github.com/Mzack9999/goimpacket/pkg/ntlm"
 	"github.com/Mzack9999/goimpacket/pkg/relay"
 	"github.com/Mzack9999/goimpacket/pkg/utf16le"
-	jsoniter "github.com/json-iterator/go"
 	"github.com/projectdiscovery/gologger"
 )
 
@@ -80,7 +80,7 @@ func runNTLMCapture(ctx context.Context, srv relay.ProtocolServer, protocolName
 			RemoteAddress: auth.SourceAddr,
 			Timestamp:     time.Now(),
 		}
-		data, err := jsoniter.Marshal(interaction)
+		data, err := json.Marshal(interaction)
 		if err != nil {
 			gologger.Warning().Msgf("Could not encode %s interaction: %s\n", protocolName, err)
 		} else {

pkg/server/util.go

@@ -1,11 +1,11 @@
 package server
 
 import (
+	"encoding/json"
 	"net"
 	"strconv"
 	"strings"
 
-	jsoniter "github.com/json-iterator/go"
 	"github.com/projectdiscovery/gologger"
 )
 
@@ -61,7 +61,7 @@ func formatAddress(host string, port int) string {
 // Each protocol handler builds its own protocol-specific Interaction and delegates the marshal/log/store
 // step here so every match is stored independently (see issue #1362).
 func (options *Options) storeInteraction(interaction *Interaction, correlationID string) {
-	data, err := jsoniter.Marshal(interaction)
+	data, err := json.Marshal(interaction)
 	if err != nil {
 		gologger.Warning().Msgf("Could not encode %s interaction: %s\n", interaction.Protocol, err)
 		return
@@ -75,7 +75,7 @@ func (options *Options) storeInteraction(interaction *Interaction, correlationID
 // storeRootTLDInteraction marshals interaction and persists it under id via Storage.AddInteractionWithId.
 // Used when RootTLD is enabled and the request targets a configured parent domain directly.
 func (options *Options) storeRootTLDInteraction(interaction *Interaction, id string) {
-	data, err := jsoniter.Marshal(interaction)
+	data, err := json.Marshal(interaction)
 	if err != nil {
 		gologger.Warning().Msgf("Could not encode root tld %s interaction: %s\n", interaction.Protocol, err)
 		return