pax_global_header 0000666 0000000 0000000 00000000064 15151416114 0014511 g ustar 00root root 0000000 0000000 52 comment=eec32e08c5ac51bba2d8042101f6d2622c133110
yahoo-serialize-javascript-3bf0af3/ 0000775 0000000 0000000 00000000000 15151416114 0017447 5 ustar 00root root 0000000 0000000 yahoo-serialize-javascript-3bf0af3/.github/ 0000775 0000000 0000000 00000000000 15151416114 0021007 5 ustar 00root root 0000000 0000000 yahoo-serialize-javascript-3bf0af3/.github/dependabot.yml 0000664 0000000 0000000 00000000235 15151416114 0023637 0 ustar 00root root 0000000 0000000 version: 2
updates:
- package-ecosystem: npm
directory: "/"
schedule:
interval: monthly
time: "13:00"
open-pull-requests-limit: 10
yahoo-serialize-javascript-3bf0af3/.github/workflows/ 0000775 0000000 0000000 00000000000 15151416114 0023044 5 ustar 00root root 0000000 0000000 yahoo-serialize-javascript-3bf0af3/.github/workflows/publish.yml 0000664 0000000 0000000 00000000576 15151416114 0025245 0 ustar 00root root 0000000 0000000 name: Publish
on:
push:
tags:
- 'v*'
permissions:
id-token: write
contents: read
jobs:
publish:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v6
- name: Use Node.js
uses: actions/setup-node@v6
with:
node-version: 24
- run: npm ci
- run: npm test
- run: npm publish
yahoo-serialize-javascript-3bf0af3/.github/workflows/test.yml 0000664 0000000 0000000 00000000704 15151416114 0024547 0 ustar 00root root 0000000 0000000 name: Test
on:
push:
branches: [main]
pull_request:
branches: [main]
jobs:
build:
runs-on: ubuntu-latest
strategy:
matrix:
node-version: [20, 22, 24]
steps:
- name: Checkout
uses: actions/checkout@v6
- name: Use Node.js ${{ matrix.node-version }}
uses: actions/setup-node@v6
with:
node-version: ${{ matrix.node-version }}
- run: npm ci
- run: npm test
yahoo-serialize-javascript-3bf0af3/.gitignore 0000664 0000000 0000000 00000000015 15151416114 0021433 0 ustar 00root root 0000000 0000000 node_modules
yahoo-serialize-javascript-3bf0af3/.npmignore 0000664 0000000 0000000 00000000044 15151416114 0021444 0 ustar 00root root 0000000 0000000 test/
.gitignore
.npmignore
.github
yahoo-serialize-javascript-3bf0af3/LICENSE 0000664 0000000 0000000 00000002716 15151416114 0020462 0 ustar 00root root 0000000 0000000 Copyright 2014 Yahoo! Inc.
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
* Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
* Neither the name of the Yahoo! Inc. nor the
names of its contributors may be used to endorse or promote products
derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL YAHOO! INC. BE LIABLE FOR ANY
DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
yahoo-serialize-javascript-3bf0af3/README.md 0000664 0000000 0000000 00000014610 15151416114 0020730 0 ustar 00root root 0000000 0000000 Serialize JavaScript
====================
Serialize JavaScript to a _superset_ of JSON that includes regular expressions, dates and functions.
[![npm Version][npm-badge]][npm]
## Overview
The code in this package began its life as an internal module to [express-state][]. To expand its usefulness, it now lives as `serialize-javascript` — an independent package on npm.
You're probably wondering: **What about `JSON.stringify()`!?** We've found that sometimes we need to serialize JavaScript **functions**, **regexps**, **dates**, **sets** or **maps**. A great example is a web app that uses client-side URL routing where the route definitions are regexps that need to be shared from the server to the client.
The string returned from this package's single export function is literal JavaScript which can be saved to a `.js` file, or be embedded into an HTML document by making the content of a `'
});
```
The above will produce the following string, HTML-escaped output which is safe to put into an HTML document as it will not cause the inline script element to terminate:
```js
'{"haxorXSS":"\\u003C\\u002Fscript\\u003E"}'
```
> You can pass an optional `unsafe` argument to `serialize()` for straight serialization.
### Options
The `serialize()` function accepts an `options` object as its second argument. All options are being defaulted to `undefined`:
#### `options.space`
This option is the same as the `space` argument that can be passed to [`JSON.stringify`][JSON.stringify]. It can be used to add whitespace and indentation to the serialized output to make it more readable.
```js
serialize(obj, {space: 2});
```
#### `options.isJSON`
This option is a signal to `serialize()` that the object being serialized does not contain any function or regexps values. This enables a hot-path that allows serialization to be over 3x faster. If you're serializing a lot of data, and know its pure JSON, then you can enable this option for a speed-up.
**Note:** That when using this option, the output will still be escaped to protect against XSS.
```js
serialize(obj, {isJSON: true});
```
#### `options.unsafe`
This option is to signal `serialize()` that we want to do a straight conversion, without the XSS protection. This options needs to be explicitly set to `true`. HTML characters and JavaScript line terminators will not be escaped. You will have to roll your own.
```js
serialize(obj, {unsafe: true});
```
#### `options.ignoreFunction`
This option is to signal `serialize()` that we do not want serialize JavaScript function.
Just treat function like `JSON.stringify` do, but other features will work as expected.
```js
serialize(obj, {ignoreFunction: true});
```
## Deserializing
For some use cases you might also need to deserialize the string. This is explicitly not part of this module. However, you can easily write it yourself:
```js
function deserialize(serializedJavascript){
return eval('(' + serializedJavascript + ')');
}
```
**Note:** Don't forget the parentheses around the serialized javascript, as the opening bracket `{` will be considered to be the start of a body.
## License
This software is free to use under the Yahoo! Inc. BSD license.
See the [LICENSE file][LICENSE] for license text and copyright information.
[npm]: https://www.npmjs.org/package/serialize-javascript
[npm-badge]: https://img.shields.io/npm/v/serialize-javascript.svg?style=flat-square
[express-state]: https://github.com/yahoo/express-state
[JSON.stringify]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/JSON/stringify
[LICENSE]: https://github.com/yahoo/serialize-javascript/blob/main/LICENSE
[worker threads]: https://nodejs.org/api/worker_threads.html
[closed-over variables]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Closures
yahoo-serialize-javascript-3bf0af3/index.js 0000664 0000000 0000000 00000024132 15151416114 0021116 0 ustar 00root root 0000000 0000000 /*
Copyright (c) 2014, Yahoo! Inc. All rights reserved.
Copyrights licensed under the New BSD License.
See the accompanying LICENSE file for terms.
*/
'use strict';
// Generate an internal UID to make the regexp pattern harder to guess.
var UID_LENGTH = 16;
var UID = generateUID();
var PLACE_HOLDER_REGEXP = new RegExp('(\\\\)?"@__(F|R|D|M|S|A|U|I|B|L)-' + UID + '-(\\d+)__@"', 'g');
var IS_NATIVE_CODE_REGEXP = /\{\s*\[native code\]\s*\}/g;
var IS_PURE_FUNCTION = /function.*?\(/;
var IS_ARROW_FUNCTION = /.*?=>.*?/;
var UNSAFE_CHARS_REGEXP = /[<>\/\u2028\u2029]/g;
// Regex to match and variations (case-insensitive) for XSS protection
// Matches
var SCRIPT_CLOSE_REGEXP = /<\/script[^>]*>/gi;
var RESERVED_SYMBOLS = ['*', 'async'];
// Mapping of unsafe HTML and invalid JavaScript line terminator chars to their
// Unicode char counterparts which are safe to use in JavaScript strings.
var ESCAPED_CHARS = {
'<' : '\\u003C',
'>' : '\\u003E',
'/' : '\\u002F',
'\u2028': '\\u2028',
'\u2029': '\\u2029'
};
function escapeUnsafeChars(unsafeChar) {
return ESCAPED_CHARS[unsafeChar];
}
// Escape function body for XSS protection while preserving arrow function syntax
function escapeFunctionBody(str) {
// Escape sequences and variations (case-insensitive) - the main XSS risk
// Matches
// This must be done first before other replacements
str = str.replace(SCRIPT_CLOSE_REGEXP, function(match) {
// Escape all <, /, and > characters in the closing script tag
return match.replace(//g, '\\u003E');
});
// Escape line terminators (these are always unsafe)
str = str.replace(/\u2028/g, '\\u2028');
str = str.replace(/\u2029/g, '\\u2029');
return str;
}
function generateUID() {
var bytes = crypto.getRandomValues(new Uint8Array(UID_LENGTH));
var result = '';
for(var i=0; i) while escaping
if (options && options.unsafe !== true) {
serializedFn = escapeFunctionBody(serializedFn);
}
// pure functions, example: {key: function() {}}
if(IS_PURE_FUNCTION.test(serializedFn)) {
return serializedFn;
}
// arrow functions, example: arg1 => arg1+5
if(IS_ARROW_FUNCTION.test(serializedFn)) {
return serializedFn;
}
var argsStartsAt = serializedFn.indexOf('(');
var def = serializedFn.substr(0, argsStartsAt)
.trim()
.split(' ')
.filter(function(val) { return val.length > 0 });
var nonReservedSymbols = def.filter(function(val) {
return RESERVED_SYMBOLS.indexOf(val) === -1
});
// enhanced literal objects, example: {key() {}}
if(nonReservedSymbols.length > 0) {
return (def.indexOf('async') > -1 ? 'async ' : '') + 'function'
+ (def.join('').indexOf('*') > -1 ? '*' : '')
+ serializedFn.substr(argsStartsAt);
}
// arrow functions
return serializedFn;
}
// Check if the parameter is function
if (options.ignoreFunction && typeof obj === "function") {
obj = undefined;
}
// Protects against `JSON.stringify()` returning `undefined`, by serializing
// to the literal string: "undefined".
if (obj === undefined) {
return String(obj);
}
var str;
// Creates a JSON string representation of the value.
// NOTE: Node 0.12 goes into slow mode with extra JSON.stringify() args.
if (options.isJSON && !options.space) {
str = JSON.stringify(obj);
} else {
str = JSON.stringify(obj, options.isJSON ? null : replacer, options.space);
}
// Protects against `JSON.stringify()` returning `undefined`, by serializing
// to the literal string: "undefined".
if (typeof str !== 'string') {
return String(str);
}
// Replace unsafe HTML and invalid JavaScript line terminator chars with
// their safe Unicode char counterpart. This _must_ happen before the
// regexps and functions are serialized and added back to the string.
if (options.unsafe !== true) {
str = str.replace(UNSAFE_CHARS_REGEXP, escapeUnsafeChars);
}
if (functions.length === 0 && regexps.length === 0 && dates.length === 0 && maps.length === 0 && sets.length === 0 && arrays.length === 0 && undefs.length === 0 && infinities.length === 0 && bigInts.length === 0 && urls.length === 0) {
return str;
}
// Replaces all occurrences of function, regexp, date, map and set placeholders in the
// JSON string with their string representations. If the original value can
// not be found, then `undefined` is used.
return str.replace(PLACE_HOLDER_REGEXP, function (match, backSlash, type, valueIndex) {
// The placeholder may not be preceded by a backslash. This is to prevent
// replacing things like `"a\"@__R--0__@"` and thus outputting
// invalid JS.
if (backSlash) {
return match;
}
if (type === 'D') {
// Validate ISO string format to prevent code injection via spoofed toISOString()
var isoStr = String(dates[valueIndex].toISOString());
if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{3})?Z$/.test(isoStr)) {
throw new TypeError('Invalid Date ISO string');
}
return "new Date(\"" + isoStr + "\")";
}
if (type === 'R') {
// Sanitize flags to prevent code injection (only allow valid RegExp flag characters)
var flags = String(regexps[valueIndex].flags).replace(/[^gimsuydv]/g, '');
return "new RegExp(" + serialize(regexps[valueIndex].source) + ", \"" + flags + "\")";
}
if (type === 'M') {
return "new Map(" + serialize(Array.from(maps[valueIndex].entries()), options) + ")";
}
if (type === 'S') {
return "new Set(" + serialize(Array.from(sets[valueIndex].values()), options) + ")";
}
if (type === 'A') {
return "Array.prototype.slice.call(" + serialize(Object.assign({ length: arrays[valueIndex].length }, arrays[valueIndex]), options) + ")";
}
if (type === 'U') {
return 'undefined'
}
if (type === 'I') {
return infinities[valueIndex];
}
if (type === 'B') {
return "BigInt(\"" + bigInts[valueIndex] + "\")";
}
if (type === 'L') {
return "new URL(" + serialize(urls[valueIndex].toString(), options) + ")";
}
var fn = functions[valueIndex];
return serializeFunc(fn, options);
});
}
yahoo-serialize-javascript-3bf0af3/package-lock.json 0000664 0000000 0000000 00000002335 15151416114 0022666 0 ustar 00root root 0000000 0000000 {
"name": "serialize-javascript",
"version": "7.0.4",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "serialize-javascript",
"version": "7.0.4",
"license": "BSD-3-Clause",
"devDependencies": {
"benchmark": "^2.1.4"
},
"engines": {
"node": ">=20.0.0"
}
},
"node_modules/benchmark": {
"version": "2.1.4",
"resolved": "https://registry.npmjs.org/benchmark/-/benchmark-2.1.4.tgz",
"integrity": "sha1-CfPeMckWQl1JjMLuVloOvzwqVik=",
"dev": true,
"dependencies": {
"lodash": "^4.17.4",
"platform": "^1.3.3"
}
},
"node_modules/lodash": {
"version": "4.17.23",
"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
"integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
"dev": true,
"license": "MIT"
},
"node_modules/platform": {
"version": "1.3.5",
"resolved": "https://registry.npmjs.org/platform/-/platform-1.3.5.tgz",
"integrity": "sha512-TuvHS8AOIZNAlE77WUDiR4rySV/VMptyMfcfeoMgs4P8apaZM3JrnbzBiixKUv+XR6i+BXrQh8WAnjaSPFO65Q==",
"dev": true
}
}
}
yahoo-serialize-javascript-3bf0af3/package.json 0000664 0000000 0000000 00000001513 15151416114 0021735 0 ustar 00root root 0000000 0000000 {
"name": "serialize-javascript",
"version": "7.0.4",
"description": "Serialize JavaScript to a superset of JSON that includes regular expressions and functions.",
"main": "index.js",
"scripts": {
"benchmark": "node -v && node test/benchmark/serialize.js",
"test": "node --test test/unit/*.js"
},
"repository": {
"type": "git",
"url": "git+https://github.com/yahoo/serialize-javascript.git"
},
"keywords": [
"serialize",
"serialization",
"javascript",
"js",
"json"
],
"author": "Eric Ferraiuolo ",
"license": "BSD-3-Clause",
"bugs": {
"url": "https://github.com/yahoo/serialize-javascript/issues"
},
"homepage": "https://github.com/yahoo/serialize-javascript",
"devDependencies": {
"benchmark": "^2.1.4"
},
"engines": {
"node": ">=20.0.0"
}
}
yahoo-serialize-javascript-3bf0af3/test/ 0000775 0000000 0000000 00000000000 15151416114 0020426 5 ustar 00root root 0000000 0000000 yahoo-serialize-javascript-3bf0af3/test/benchmark/ 0000775 0000000 0000000 00000000000 15151416114 0022360 5 ustar 00root root 0000000 0000000 yahoo-serialize-javascript-3bf0af3/test/benchmark/serialize.js 0000664 0000000 0000000 00000002452 15151416114 0024710 0 ustar 00root root 0000000 0000000 'use strict';
var Benchmark = require('benchmark');
var serialize = require('../../');
var suiteConfig = {
onStart: function (e) {
console.log(e.currentTarget.name + ':');
},
onCycle: function (e) {
console.log(String(e.target));
},
onComplete: function () {
console.log('');
}
};
// -- simpleOjb ----------------------------------------------------------------
var simpleObj = {
foo: 'foo',
bar: false,
num: 100,
arr: [1, 2, 3, 4],
obj: {baz: 'baz'}
};
new Benchmark.Suite('simpleObj', suiteConfig)
.add('JSON.stringify( simpleObj )', function () {
JSON.stringify(simpleObj);
})
.add('JSON.stringify( simpleObj ) with replacer', function () {
JSON.stringify(simpleObj, function (key, value) {
return value;
});
})
.add('serialize( simpleObj, {isJSON: true} )', function () {
serialize(simpleObj, {isJSON: true});
})
.add('serialize( simpleObj, {unsafe: true} )', function () {
serialize(simpleObj, {unsafe: true});
})
.add('serialize( simpleObj, {unsafe: true, isJSON: true} )', function () {
serialize(simpleObj, {unsafe: true, isJSON: true});
})
.add('serialize( simpleObj )', function () {
serialize(simpleObj);
})
.run();
yahoo-serialize-javascript-3bf0af3/test/unit/ 0000775 0000000 0000000 00000000000 15151416114 0021405 5 ustar 00root root 0000000 0000000 yahoo-serialize-javascript-3bf0af3/test/unit/serialize.js 0000664 0000000 0000000 00000071547 15151416114 0023750 0 ustar 00root root 0000000 0000000 const { beforeEach, describe, it } = require('node:test');
const { deepStrictEqual, strictEqual, throws } = require('node:assert');
var serialize = require('../../');
describe('serialize( obj )', function () {
it('should be a function', function () {
strictEqual(typeof serialize, 'function');
});
describe('undefined', function () {
it('should serialize `undefined` to a string', function () {
strictEqual(typeof serialize(), 'string');
strictEqual(serialize(), 'undefined');
strictEqual(typeof serialize(undefined), 'string');
strictEqual(serialize(undefined), 'undefined');
});
it('should deserialize "undefined" to `undefined`', function () {
strictEqual(eval(serialize()), undefined);
strictEqual(eval(serialize(undefined)), undefined);
});
});
describe('null', function () {
it('should serialize `null` to a string', function () {
strictEqual(typeof serialize(null), 'string');
strictEqual(serialize(null), 'null');
});
it('should deserialize "null" to `null`', function () {
strictEqual(eval(serialize(null)), null);
});
});
describe('JSON', function () {
var data;
beforeEach(function () {
data = {
str : 'string',
num : 0,
obj : {foo: 'foo'},
arr : [1, 2, 3],
bool: true,
nil : null
};
});
it('should serialize JSON to a JSON string', function () {
deepStrictEqual(serialize(data), JSON.stringify(data));
});
it('should deserialize a JSON string to a JSON object', function () {
deepStrictEqual(JSON.parse(serialize(data)), data);
});
it('should serialize weird whitespace characters correctly', function () {
var ws = String.fromCharCode(8232);
deepStrictEqual(eval(serialize(ws)), ws);
});
it('should serialize undefined correctly', function () {
var obj;
var str = '{"undef":undefined,"nest":{"undef":undefined}}';
eval('obj = ' + str);
deepStrictEqual(serialize(obj), str);
});
});
describe('functions', function () {
it('should serialize annonymous functions', function () {
var fn = function () {};
strictEqual(typeof serialize(fn), 'string');
strictEqual(serialize(fn), 'function () {}');
});
it('should deserialize annonymous functions', function () {
var fn; eval('fn = ' + serialize(function () {}));
strictEqual(typeof fn, 'function');
});
it('should serialize named functions', function () {
function fn() {}
strictEqual(typeof serialize(fn), 'string');
strictEqual(serialize(fn), 'function fn() {}');
});
it('should deserialize named functions', function () {
var fn; eval('fn = ' + serialize(function fn() {}));
strictEqual(typeof fn, 'function');
strictEqual(fn.name, 'fn');
});
it('should serialize functions with arguments', function () {
function fn(arg1, arg2) {}
strictEqual(serialize(fn), 'function fn(arg1, arg2) {}');
});
it('should deserialize functions with arguments', function () {
var fn; eval('fn = ' + serialize(function (arg1, arg2) {}));
strictEqual(typeof fn, 'function');
strictEqual(fn.length, 2);
});
it('should serialize functions with bodies', function () {
function fn() { return true; }
strictEqual(serialize(fn), 'function fn() { return true; }');
});
it('should deserialize functions with bodies', function () {
var fn; eval('fn = ' + serialize(function () { return true; }));
strictEqual(typeof fn, 'function');
strictEqual(fn(), true);
});
it('should throw a TypeError when serializing native built-ins', function () {
var err;
strictEqual(Number.toString(), 'function Number() { [native code] }');
try { serialize(Number); } catch (e) { err = e; }
strictEqual(err instanceof TypeError, true);
});
it('should serialize enhanced literal objects', function () {
var obj = {
foo() { return true; },
*bar() { return true; }
};
deepStrictEqual(serialize(obj), '{"foo":function() { return true; },"bar":function*() { return true; }}');
});
it('should deserialize enhanced literal objects', function () {
var obj;
eval('obj = ' + serialize({ hello() { return true; } }));
strictEqual(obj.hello(), true);
});
it('should serialize functions that contain dates', function () {
function fn(arg1) {return new Date('2016-04-28T22:02:17.156Z')};
strictEqual(typeof serialize(fn), 'string');
strictEqual(serialize(fn), 'function fn(arg1) {return new Date(\'2016-04-28T22:02:17.156Z\')}');
});
it('should deserialize functions that contain dates', function () {
var fn; eval('fn = ' + serialize(function () { return new Date('2016-04-28T22:02:17.156Z') }));
strictEqual(typeof fn, 'function');
strictEqual(fn().getTime(), new Date('2016-04-28T22:02:17.156Z').getTime());
});
it('should serialize functions that return other functions', function () {
function fn() {return function(arg1) {return arg1 + 5}};
strictEqual(typeof serialize(fn), 'string');
strictEqual(serialize(fn), 'function fn() {return function(arg1) {return arg1 + 5}}');
});
it('should deserialize functions that return other functions', function () {
var fn; eval('fn = ' + serialize(function () { return function(arg1) {return arg1 + 5} }));
strictEqual(typeof fn, 'function');
strictEqual(fn()(7), 12);
});
});
describe('arrow-functions', function () {
it('should serialize arrow functions', function () {
var fn = () => {};
strictEqual(typeof serialize(fn), 'string');
strictEqual(serialize(fn), '() => {}');
});
it('should deserialize arrow functions', function () {
var fn; eval('fn = ' + serialize(() => true));
strictEqual(typeof fn, 'function');
strictEqual(fn(), true);
});
it('should serialize arrow functions with one argument', function () {
var fn = arg1 => {}
strictEqual(typeof serialize(fn), 'string');
strictEqual(serialize(fn), 'arg1 => {}');
});
it('should deserialize arrow functions with one argument', function () {
var fn; eval('fn = ' + serialize(arg1 => {}));
strictEqual(typeof fn, 'function');
strictEqual(fn.length, 1);
});
it('should serialize arrow functions with multiple arguments', function () {
var fn = (arg1, arg2) => {}
strictEqual(serialize(fn), '(arg1, arg2) => {}');
});
it('should deserialize arrow functions with multiple arguments', function () {
var fn; eval('fn = ' + serialize( (arg1, arg2) => {}));
strictEqual(typeof fn, 'function');
strictEqual(fn.length, 2);
});
it('should serialize arrow functions with bodies', function () {
var fn = () => { return true; }
strictEqual(serialize(fn), '() => { return true; }');
});
it('should deserialize arrow functions with bodies', function () {
var fn; eval('fn = ' + serialize( () => { return true; }));
strictEqual(typeof fn, 'function');
strictEqual(fn(), true);
});
it('should serialize enhanced literal objects', function () {
var obj = {
foo: () => { return true; },
bar: arg1 => { return true; },
baz: (arg1, arg2) => { return true; }
};
strictEqual(serialize(obj), '{"foo":() => { return true; },"bar":arg1 => { return true; },"baz":(arg1, arg2) => { return true; }}');
});
it('should deserialize enhanced literal objects', function () {
var obj;
eval('obj = ' + serialize({ foo: () => { return true; },
foo: () => { return true; },
bar: arg1 => { return true; },
baz: (arg1, arg2) => { return true; }
}));
strictEqual(obj.foo(), true);
strictEqual(obj.bar('arg1'), true);
strictEqual(obj.baz('arg1', 'arg1'), true);
});
it('should serialize arrow functions with added properties', function () {
var fn = () => {};
fn.property1 = 'a string'
strictEqual(typeof serialize(fn), 'string');
strictEqual(serialize(fn), '() => {}');
});
it('should deserialize arrow functions with added properties', function () {
var fn; eval('fn = ' + serialize( () => { this.property1 = 'a string'; return 5 }));
strictEqual(typeof fn, 'function');
strictEqual(fn(), 5);
});
it('should serialize arrow functions that return other functions', function () {
var fn = arg1 => { return arg2 => arg1 + arg2 };
strictEqual(typeof serialize(fn), 'string');
strictEqual(serialize(fn), 'arg1 => { return arg2 => arg1 + arg2 }');
});
it('should deserialize arrow functions that return other functions', function () {
var fn; eval('fn = ' + serialize(arg1 => { return arg2 => arg1 + arg2 } ));
strictEqual(typeof fn, 'function');
strictEqual(fn(2)(3), 5);
});
});
describe('regexps', function () {
it('should serialize constructed regexps', function () {
var re = new RegExp('asdf');
strictEqual(typeof serialize(re), 'string');
strictEqual(serialize(re), 'new RegExp("asdf", "")');
});
it('should deserialize constructed regexps', function () {
var re = eval(serialize(new RegExp('asdf')));
strictEqual(re instanceof RegExp, true);
strictEqual(re.source, 'asdf');
});
it('should serialize literal regexps', function () {
var re = /asdf/;
strictEqual(typeof serialize(re), 'string');
strictEqual(serialize(re), 'new RegExp("asdf", "")');
});
it('should deserialize literal regexps', function () {
var re = eval(serialize(/asdf/));
strictEqual(re instanceof RegExp, true);
strictEqual(re.source, 'asdf');
});
it('should serialize regexps with flags', function () {
var re = /^asdf$/gi;
strictEqual(serialize(re), 'new RegExp("^asdf$", "gi")');
});
it('should deserialize regexps with flags', function () {
var re = eval(serialize(/^asdf$/gi));
strictEqual(re instanceof RegExp, true);
strictEqual(re.global, true);
strictEqual(re.ignoreCase, true);
strictEqual(re.multiline, false);
});
it('should serialize regexps with escaped chars', function () {
strictEqual(serialize(/\..*/), 'new RegExp("\\\\..*", "")');
strictEqual(serialize(new RegExp('\\..*')), 'new RegExp("\\\\..*", "")');
});
it('should deserialize regexps with escaped chars', function () {
var re = eval(serialize(/\..*/));
strictEqual(re instanceof RegExp, true);
strictEqual(re.source, '\\..*');
re = eval(serialize(new RegExp('\\..*')));
strictEqual(re instanceof RegExp, true);
strictEqual(re.source, '\\..*');
});
it('should serialize dangerous regexps', function () {
var re = /[<\/script>'), '"\\u003C\\u002Fscript\\u003E"');
strictEqual(JSON.parse(serialize('')), '');
strictEqual(eval(serialize('')), '');
strictEqual(serialize(new URL('x:')), 'new URL("x:\\u003C\\u002Fscript\\u003E")');
strictEqual(eval(serialize(new URL('x:'))).href, 'x:');
});
it('should encode unsafe HTML chars in function bodies', function () {
function fn() { return ''; }
var serialized = serialize(fn);
strictEqual(serialized.includes('\\u003C\\u002Fscript\\u003E'), true);
strictEqual(serialized.includes(''), false);
// Verify the function still works after deserialization
var deserialized; eval('deserialized = ' + serialized);
strictEqual(typeof deserialized, 'function');
strictEqual(deserialized(), '');
});
it('should encode unsafe HTML chars in arrow function bodies', function () {
var fn = () => { return ''; };
var serialized = serialize(fn);
strictEqual(serialized.includes('\\u003C\\u002Fscript\\u003E'), true);
strictEqual(serialized.includes(''), false);
// Verify the function still works after deserialization
var deserialized; eval('deserialized = ' + serialized);
strictEqual(typeof deserialized, 'function');
strictEqual(deserialized(), '');
});
it('should encode unsafe HTML chars in enhanced literal object methods', function () {
var obj = {
fn() { return ''; }
};
var serialized = serialize(obj);
strictEqual(serialized.includes('\\u003C\\u002Fscript\\u003E'), true);
strictEqual(serialized.includes(''), false);
// Verify the function still works after deserialization
var deserialized; eval('deserialized = ' + serialized);
strictEqual(deserialized.fn(), '');
});
it('should not escape function bodies when unsafe option is true', function () {
function fn() { return ''; }
var serialized = serialize(fn, {unsafe: true});
strictEqual(serialized.includes(''), true);
strictEqual(serialized.includes('\\u003C\\u002Fscript\\u003E'), false);
});
it('should encode with space before >', function () {
function fn() { return ''; }
var serialized = serialize(fn);
strictEqual(serialized.includes('\\u003C\\u002Fscript'), true);
strictEqual(serialized.includes('');
});
it('should encode with attributes', function () {
function fn() { return ''; }
var serialized = serialize(fn);
strictEqual(serialized.includes('\\u003C\\u002Fscript'), true);
strictEqual(serialized.includes('');
});
it('should encode ', function () {
function fn() { return ''; }
var serialized = serialize(fn);
strictEqual(serialized.includes('\\u003C\\u002Fscript'), true);
strictEqual(serialized.includes('');
});
});
describe('options', function () {
it('should accept options as the second argument', function () {
strictEqual(serialize('foo', {}), '"foo"');
});
it('should accept a `space` option', function () {
strictEqual(serialize([1], {space: 0}), '[1]');
strictEqual(serialize([1], {space: ''}), '[1]');
strictEqual(serialize([1], {space: undefined}), '[1]');
strictEqual(serialize([1], {space: null}), '[1]');
strictEqual(serialize([1], {space: false}), '[1]');
strictEqual(serialize([1], {space: 1}), '[\n 1\n]');
strictEqual(serialize([1], {space: ' '}), '[\n 1\n]');
strictEqual(serialize([1], {space: 2}), '[\n 1\n]');
});
it('should accept a `isJSON` option', function () {
strictEqual(serialize('foo', {isJSON: true}), '"foo"');
strictEqual(serialize('foo', {isJSON: false}), '"foo"');
function fn() { return true; }
strictEqual(serialize(fn), 'function fn() { return true; }');
strictEqual(serialize(fn, {isJSON: false}), 'function fn() { return true; }');
strictEqual(serialize(fn, {isJSON: true}), 'undefined');
strictEqual(serialize([1], {isJSON: true, space: 2}), '[\n 1\n]');
});
it('should accept a `unsafe` option', function () {
strictEqual(serialize('foo', {unsafe: true}), '"foo"');
strictEqual(serialize('foo', {unsafe: false}), '"foo"');
function fn() { return true; }
strictEqual(serialize(fn), 'function fn() { return true; }');
strictEqual(serialize(fn, {unsafe: false}), 'function fn() { return true; }');
strictEqual(serialize(fn, {unsafe: undefined}), 'function fn() { return true; }');
strictEqual(serialize(fn, {unsafe: "true"}), 'function fn() { return true; }');
strictEqual(serialize(fn, {unsafe: true}), 'function fn() { return true; }');
strictEqual(serialize(["1"], {unsafe: false, space: 2}), '[\n "1"\n]');
strictEqual(serialize(["1"], {unsafe: true, space: 2}), '[\n "1"\n]');
strictEqual(serialize(["<"], {space: 2}), '[\n "\\u003C"\n]');
strictEqual(serialize(["<"], {unsafe: true, space: 2}), '[\n "<"\n]');
});
it("should accept a `ignoreFunction` option", function() {
function fn() { return true; }
var obj = {
fn: fn,
fn_arrow: () => {
return true;
}
};
var obj2 = {
num: 123,
str: 'str',
fn: fn
}
// case 1. Pass function to serialize
strictEqual(serialize(fn, { ignoreFunction: true }), 'undefined');
// case 2. Pass function(arrow) in object to serialze
strictEqual(serialize(obj, { ignoreFunction: true }), '{}');
// case 3. Other features should work
strictEqual(serialize(obj2, { ignoreFunction: true }),
'{"num":123,"str":"str"}'
);
});
});
describe('backwards-compatability', function () {
it('should accept `space` as the second argument', function () {
strictEqual(serialize([1], 0), '[1]');
strictEqual(serialize([1], ''), '[1]');
strictEqual(serialize([1], undefined), '[1]');
strictEqual(serialize([1], null), '[1]');
strictEqual(serialize([1], false), '[1]');
strictEqual(serialize([1], 1), '[\n 1\n]');
strictEqual(serialize([1], ' '), '[\n 1\n]');
strictEqual(serialize([1], 2), '[\n 1\n]');
});
});
describe('placeholders', function() {
it('should not be replaced within string literals', function () {
// Since we made the UID deterministic this should always be the placeholder
var fakePlaceholder = '"@__R-0000000000000000-0__@';
var serialized = serialize({bar: /1/i, foo: fakePlaceholder}, {uid: 'foo'});
var obj = eval('(' + serialized + ')');
strictEqual(typeof obj, 'object');
strictEqual(typeof obj.foo, 'string');
strictEqual(obj.foo, fakePlaceholder);
});
});
});