Repository navigation
feature: Decode mode should support same Map key Sort options as Encode #734
Description
Is your feature request related to a problem? Please describe.
Deterministic Unmarshal fails to detect non deterministic payloads where the difference is key ordering.
Arguably this is pretty important for any system requiring deterministic input, as usually the producer is an uncontrolled client who can make any CBOR payload with any encoder, and the consumer needs to ensure its validly formatted.
Anyone relying on this library to check deterministic encoding of a payload will unsuspectingly pass non deterministic payloads as valid.
Describe the solution you'd like
The same Sort options available on the Encoder should be present and checked on the Decoder.
Describe alternatives you've considered
Re-encoding and comparing, works, but its a reasonable perf hit for just checking map keys are in the correct order which is easy at decode time. Its also NOT obvious one needs to do this, which means there is a reasonable chance its not done and so implementations relying on this have potential vulnerabilities.
Activity
fxamacker commentedon Jan 4, 2026
Hi @stevenj, thanks for opening this issue!
I agree that adding decoding options to check sort order of CBOR map keys would be a useful feature.
Depending on implementation, adding this feature will add overhead to CBOR map decoding (even for users that don't use any new options), so I will need to look into minimizing such overhead.
Before adding this feature, I need to release unrelated in-progress work because it modifies the same part of the decoder the new sort options is likely modify.