Unexpected security footguns in Go's parsers