pax_global_header00006660000000000000000000000064133015126660014515gustar00rootroot0000000000000052 comment=21c0afaf22f6c78d26cf47ee6884b58906bed062 safe-json-stringify-1.2.0/000077500000000000000000000000001330151266600154165ustar00rootroot00000000000000safe-json-stringify-1.2.0/.gitignore000066400000000000000000000000161330151266600174030ustar00rootroot00000000000000/node_modules/safe-json-stringify-1.2.0/.npmignore000066400000000000000000000000061330151266600174110ustar00rootroot00000000000000/test safe-json-stringify-1.2.0/.travis.yml000066400000000000000000000001131330151266600175220ustar00rootroot00000000000000language: node_js node_js: - "9" - "8" - "7" - "6" - "5" - "4" safe-json-stringify-1.2.0/README.md000066400000000000000000000115471330151266600167050ustar00rootroot00000000000000# Safe JSON Stringify [![Build Status](https://travis-ci.org/debitoor/safe-json-stringify.svg?branch=master)](https://travis-ci.org/debitoor/safe-json-stringify) [![NPM Version](https://img.shields.io/npm/v/safe-json-stringify.svg)](https://www.npmjs.com/package/safe-json-stringify) A wrapper for `JSON.stringify` that handles circular references and prevents defined getters from throwing errors. Circular references are handled by returning `[Circular]` when a circular reference is spotted. Defined getters that throw errors are handled by returning `[Throws]`. Usage ----- Install it using NPM ```sh npm install safe-json-stringify ``` And require it into your Node project. ```js const safeJsonStringify = require('safe-json-stringify'); const data = {foo: 'bar'} console.log(safeJsonStringify(data)); ``` All the parameters of `JSON.stringify` are accepted, try e.g. the following for a nicely formatted output: ```js console.log(safeJsonStringify(data, null, 2)); ``` An `ensureProperties` function is exposed too, which returns a safe object without the stringify step. Usage: `safeJsonStringify.ensureProperties(data);`. Why? ---- The `stringify` function on the JavaScript JSON object will take any data and return a string representation of said data. If this data contains an object literal it will attempt to return the values of any enumerable property set on this object. This can be dangerous because JavaScript supports a couple of ways to define property getters on objects. The old, non-standard, and now deprecated `Object.prototype.__defineGetter__()` will define a named property which value is the return of a given function. ```js // Never ever do this in your code. Please. var obj = {}; obj.__defineGetter__('foo', function() { return 'bar'; }); JSON.stringify(obj); // {"foo":"bar"} ``` This is kinda bad because we could make that function throw an error. ```js // Never ever do this in your code. Please. var obj = {}; obj.__defineGetter__('foo', function() { throw new Error('ouch!'); }); JSON.stringify(obj); // error thrown ``` This property is created as an enumerable on the object, so the object from the previous example would make any function that iterates choke and throw an error. This is bad because one would never expect a simple property get to throw an error and bring down a system. `JSON.stringify` will blindly trust any object property, and will throw an error if it hits a defined property that throws an error. This could potentially take down your program. The slightly better `Object.defineProperty()` does the same thing, but has the common courtesy to not define the getter as enumerable--that is per default. The following example would bring us in the same situation as with `__defineGetter__`. ```js // Never ever do this in your code. Please. var obj = {}; Object.defineProperty(obj, 'foo', { get: function() { throw new Error('ouch!'); }, enumerable: true // enumerable is false by default }); JSON.stringify(obj); // error thrown ``` So, we can not trust any of them. One could argue that they should never be used, and we can, and should, apply that principle to our own software, but we cannot trust code from third-party modules. If data from third-party modules are to be stringified by JSON we should take these situations into considerations. This module attempt to do that by spotting defined getters and return "[Throws]" if said getter throws an error. ```js var safeJsonStringify = require('safe-json-stringify'); // Never ever do this in your code. Please. var obj = {}; Object.defineProperty(obj, 'foo', { get: function() { throw new Error('ouch!'); }, enumerable: true }); safeJsonStringify(obj); // '{"foo":"[Throws]"}' ``` And it attempts to handle circular references too. It returns "[Circular]" if it spots one. License ------- The MIT License (MIT) Copyright (c) 2014-2017 [Debitoor](https://debitoor.com/) Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. safe-json-stringify-1.2.0/index.js000066400000000000000000000025031330151266600170630ustar00rootroot00000000000000var hasProp = Object.prototype.hasOwnProperty; function throwsMessage(err) { return '[Throws: ' + (err ? err.message : '?') + ']'; } function safeGetValueFromPropertyOnObject(obj, property) { if (hasProp.call(obj, property)) { try { return obj[property]; } catch (err) { return throwsMessage(err); } } return obj[property]; } function ensureProperties(obj) { var seen = [ ]; // store references to objects we have seen before function visit(obj) { if (obj === null || typeof obj !== 'object') { return obj; } if (seen.indexOf(obj) !== -1) { return '[Circular]'; } seen.push(obj); if (typeof obj.toJSON === 'function') { try { var fResult = visit(obj.toJSON()); seen.pop(); return fResult; } catch(err) { return throwsMessage(err); } } if (Array.isArray(obj)) { var aResult = obj.map(visit); seen.pop(); return aResult; } var result = Object.keys(obj).reduce(function(result, prop) { // prevent faulty defined getter properties result[prop] = visit(safeGetValueFromPropertyOnObject(obj, prop)); return result; }, {}); seen.pop(); return result; }; return visit(obj); } module.exports = function(data, replacer, space) { return JSON.stringify(ensureProperties(data), replacer, space); } module.exports.ensureProperties = ensureProperties; safe-json-stringify-1.2.0/package-lock.json000066400000000000000000000222031330151266600206310ustar00rootroot00000000000000{ "name": "safe-json-stringify", "version": "1.2.0", "lockfileVersion": 1, "requires": true, "dependencies": { "balanced-match": { "version": "1.0.0", "resolved": "http://npm.paypal.com/repository/npm-all/balanced-match/-/balanced-match-1.0.0.tgz", "integrity": "sha1-ibTRmasr7kneFk6gK4nORi1xt2c=", "dev": true }, "brace-expansion": { "version": "1.1.8", "resolved": "http://npm.paypal.com/repository/npm-all/brace-expansion/-/brace-expansion-1.1.8.tgz", "integrity": "sha1-wHshHHyVLsH479Uad+8NHTmQopI=", "dev": true, "requires": { "balanced-match": "1.0.0", "concat-map": "0.0.1" } }, "concat-map": { "version": "0.0.1", "resolved": "http://npm.paypal.com/repository/npm-all/concat-map/-/concat-map-0.0.1.tgz", "integrity": "sha1-2Klr13/Wjfd5OnMDajug1UBdR3s=", "dev": true }, "deep-equal": { "version": "1.0.1", "resolved": "http://npm.paypal.com/repository/npm-all/deep-equal/-/deep-equal-1.0.1.tgz", "integrity": "sha1-9dJgKStmDghO/0zbyfCK0yR0SLU=", "dev": true }, "define-properties": { "version": "1.1.2", "resolved": "http://npm.paypal.com/repository/npm-all/define-properties/-/define-properties-1.1.2.tgz", "integrity": "sha1-g6c/L+pWmJj7c3GTyPhzyvbUXJQ=", "dev": true, "requires": { "foreach": "2.0.5", "object-keys": "1.0.11" } }, "defined": { "version": "1.0.0", "resolved": "http://npm.paypal.com/repository/npm-all/defined/-/defined-1.0.0.tgz", "integrity": "sha1-yY2bzvdWdBiOEQlpFRGZ45sfppM=", "dev": true }, "es-abstract": { "version": "1.8.0", "resolved": "http://npm.paypal.com/repository/npm-all/es-abstract/-/es-abstract-1.8.0.tgz", "integrity": "sha512-Cf9/h5MrXtExM20gSS55YFrGKCyPrRBjIVBtVyy8vmlsDfe0NPKMWj65tPLgzyfPuapWxh5whpXCtW4+AW5mRg==", "dev": true, "requires": { "es-to-primitive": "1.1.1", "function-bind": "1.1.0", "has": "1.0.1", "is-callable": "1.1.3", "is-regex": "1.0.4" } }, "es-to-primitive": { "version": "1.1.1", "resolved": "http://npm.paypal.com/repository/npm-all/es-to-primitive/-/es-to-primitive-1.1.1.tgz", "integrity": "sha1-RTVSSKiJeQNLZ5Lhm7gfK3l13Q0=", "dev": true, "requires": { "is-callable": "1.1.3", "is-date-object": "1.0.1", "is-symbol": "1.0.1" } }, "for-each": { "version": "0.3.2", "resolved": "http://npm.paypal.com/repository/npm-all/for-each/-/for-each-0.3.2.tgz", "integrity": "sha1-LEBFC5NI6X8oEyJZO6lnBLmr1NQ=", "dev": true, "requires": { "is-function": "1.0.1" } }, "foreach": { "version": "2.0.5", "resolved": "http://npm.paypal.com/repository/npm-all/foreach/-/foreach-2.0.5.tgz", "integrity": "sha1-C+4AUBiusmDQo6865ljdATbsG5k=", "dev": true }, "fs.realpath": { "version": "1.0.0", "resolved": "http://npm.paypal.com/repository/npm-all/fs.realpath/-/fs.realpath-1.0.0.tgz", "integrity": "sha1-FQStJSMVjKpA20onh8sBQRmU6k8=", "dev": true }, "function-bind": { "version": "1.1.0", "resolved": "http://npm.paypal.com/repository/npm-all/function-bind/-/function-bind-1.1.0.tgz", "integrity": "sha1-FhdnFMgBeY5Ojyz391KUZ7tKV3E=", "dev": true }, "glob": { "version": "7.1.2", "resolved": "http://npm.paypal.com/repository/npm-all/glob/-/glob-7.1.2.tgz", "integrity": "sha512-MJTUg1kjuLeQCJ+ccE4Vpa6kKVXkPYJ2mOCQyUuKLcLQsdrMCpBPUi8qVE6+YuaJkozeA9NusTAw3hLr8Xe5EQ==", "dev": true, "requires": { "fs.realpath": "1.0.0", "inflight": "1.0.6", "inherits": "2.0.3", "minimatch": "3.0.4", "once": "1.4.0", "path-is-absolute": "1.0.1" } }, "has": { "version": "1.0.1", "resolved": "http://npm.paypal.com/repository/npm-all/has/-/has-1.0.1.tgz", "integrity": "sha1-hGFzP1OLCDfJNh45qauelwTcLyg=", "dev": true, "requires": { "function-bind": "1.1.0" } }, "inflight": { "version": "1.0.6", "resolved": "http://npm.paypal.com/repository/npm-all/inflight/-/inflight-1.0.6.tgz", "integrity": "sha1-Sb1jMdfQLQwJvJEKEHW6gWW1bfk=", "dev": true, "requires": { "once": "1.4.0", "wrappy": "1.0.2" } }, "inherits": { "version": "2.0.3", "resolved": "http://npm.paypal.com/repository/npm-all/inherits/-/inherits-2.0.3.tgz", "integrity": "sha1-Yzwsg+PaQqUC9SRmAiSA9CCCYd4=", "dev": true }, "is-callable": { "version": "1.1.3", "resolved": "http://npm.paypal.com/repository/npm-all/is-callable/-/is-callable-1.1.3.tgz", "integrity": "sha1-hut1OSgF3cM69xySoO7fdO52BLI=", "dev": true }, "is-date-object": { "version": "1.0.1", "resolved": "http://npm.paypal.com/repository/npm-all/is-date-object/-/is-date-object-1.0.1.tgz", "integrity": "sha1-mqIOtq7rv/d/vTPnTKAbM1gdOhY=", "dev": true }, "is-function": { "version": "1.0.1", "resolved": "http://npm.paypal.com/repository/npm-all/is-function/-/is-function-1.0.1.tgz", "integrity": "sha1-Es+5i2W1fdPRk6MSH19uL0N2ArU=", "dev": true }, "is-regex": { "version": "1.0.4", "resolved": "http://npm.paypal.com/repository/npm-all/is-regex/-/is-regex-1.0.4.tgz", "integrity": "sha1-VRdIm1RwkbCTDglWVM7SXul+lJE=", "dev": true, "requires": { "has": "1.0.1" } }, "is-symbol": { "version": "1.0.1", "resolved": "http://npm.paypal.com/repository/npm-all/is-symbol/-/is-symbol-1.0.1.tgz", "integrity": "sha1-PMWfAAJRlLarLjjbrmaJJWtmBXI=", "dev": true }, "minimatch": { "version": "3.0.4", "resolved": "http://npm.paypal.com/repository/npm-all/minimatch/-/minimatch-3.0.4.tgz", "integrity": "sha512-yJHVQEhyqPLUTgt9B83PXu6W3rx4MvvHvSUvToogpwoGDOUQ+yDrR0HRot+yOCdCO7u4hX3pWft6kWBBcqh0UA==", "dev": true, "requires": { "brace-expansion": "1.1.8" } }, "minimist": { "version": "1.2.0", "resolved": "http://npm.paypal.com/repository/npm-all/minimist/-/minimist-1.2.0.tgz", "integrity": "sha1-o1AIsg9BOD7sH7kU9M1d95omQoQ=", "dev": true }, "object-inspect": { "version": "1.2.2", "resolved": "http://npm.paypal.com/repository/npm-all/object-inspect/-/object-inspect-1.2.2.tgz", "integrity": "sha1-yCEV5PzIiK6hTWTCLk8X9qcNXlo=", "dev": true }, "object-keys": { "version": "1.0.11", "resolved": "http://npm.paypal.com/repository/npm-all/object-keys/-/object-keys-1.0.11.tgz", "integrity": "sha1-xUYBd4rVYPEULODgG8yotW0TQm0=", "dev": true }, "once": { "version": "1.4.0", "resolved": "http://npm.paypal.com/repository/npm-all/once/-/once-1.4.0.tgz", "integrity": "sha1-WDsap3WWHUsROsF9nFC6753Xa9E=", "dev": true, "requires": { "wrappy": "1.0.2" } }, "path-is-absolute": { "version": "1.0.1", "resolved": "http://npm.paypal.com/repository/npm-all/path-is-absolute/-/path-is-absolute-1.0.1.tgz", "integrity": "sha1-F0uSaHNVNP+8es5r9TpanhtcX18=", "dev": true }, "resolve": { "version": "1.1.7", "resolved": "http://npm.paypal.com/repository/npm-all/resolve/-/resolve-1.1.7.tgz", "integrity": "sha1-IDEU2CrSxe2ejgQRs5ModeiJ6Xs=", "dev": true }, "resumer": { "version": "0.0.0", "resolved": "http://npm.paypal.com/repository/npm-all/resumer/-/resumer-0.0.0.tgz", "integrity": "sha1-8ej0YeQGS6Oegq883CqMiT0HZ1k=", "dev": true, "requires": { "through": "2.3.8" } }, "string.prototype.trim": { "version": "1.1.2", "resolved": "http://npm.paypal.com/repository/npm-all/string.prototype.trim/-/string.prototype.trim-1.1.2.tgz", "integrity": "sha1-0E3iyJ4Tf019IG8Ia17S+ua+jOo=", "dev": true, "requires": { "define-properties": "1.1.2", "es-abstract": "1.8.0", "function-bind": "1.1.0" } }, "tape": { "version": "4.6.3", "resolved": "http://npm.paypal.com/repository/npm-all/tape/-/tape-4.6.3.tgz", "integrity": "sha1-Y353WB6ass4XV36b1M5PV1gG2LY=", "dev": true, "requires": { "deep-equal": "1.0.1", "defined": "1.0.0", "for-each": "0.3.2", "function-bind": "1.1.0", "glob": "7.1.2", "has": "1.0.1", "inherits": "2.0.3", "minimist": "1.2.0", "object-inspect": "1.2.2", "resolve": "1.1.7", "resumer": "0.0.0", "string.prototype.trim": "1.1.2", "through": "2.3.8" } }, "through": { "version": "2.3.8", "resolved": "http://npm.paypal.com/repository/npm-all/through/-/through-2.3.8.tgz", "integrity": "sha1-DdTJ/6q8NXlgsbckEV1+Doai4fU=", "dev": true }, "wrappy": { "version": "1.0.2", "resolved": "http://npm.paypal.com/repository/npm-all/wrappy/-/wrappy-1.0.2.tgz", "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8=", "dev": true } } } safe-json-stringify-1.2.0/package.json000066400000000000000000000012131330151266600177010ustar00rootroot00000000000000{ "name": "safe-json-stringify", "version": "1.2.0", "repository": { "type": "git", "url": "git@github.com:debitoor/safe-json-stringify.git" }, "bugs": { "url": "https://github.com/debitoor/safe-json-stringify/issues" }, "homepage": "https://github.com/debitoor/safe-json-stringify", "description": "Prevent defined property getters from throwing errors", "main": "index.js", "scripts": { "postversion": "git push && git push --tags", "preversion": "npm test", "test": "tape test/safe-json-stringify-test.js" }, "author": "Debitoor", "license": "MIT", "devDependencies": { "tape": "4.6.3" } } safe-json-stringify-1.2.0/test/000077500000000000000000000000001330151266600163755ustar00rootroot00000000000000safe-json-stringify-1.2.0/test/safe-json-stringify-test.js000066400000000000000000000106301330151266600236110ustar00rootroot00000000000000var test = require('tape'); var safeJsonStringify = require('../index'); test('basic stringify', function(t) { t.plan(2); t.equal('"foo"', safeJsonStringify('foo'), 'a simple string'); t.equal('{"foo":"bar"}', safeJsonStringify({foo: 'bar'}), 'a simple object'); }); test('object identity', function(t) { t.plan(1); var a = { foo: 'bar' }; var b = { one: a, two: a }; t.equal('{"one":{"foo":"bar"},"two":{"foo":"bar"}}',safeJsonStringify(b),'an object with identical properties'); }); test('circular references', function(t) { t.plan(2); var a = {}; a.a = a; a.b = 'c'; t.doesNotThrow( function() { safeJsonStringify(a); }, 'should not exceed stack size' ); t.equal( '{"a":"[Circular]","b":"c"}', safeJsonStringify(a), 'should return [Circular] for circular references' ); }); test('null', function(t) { t.plan(1); t.equal( '{"x":null}', safeJsonStringify({x: null}), 'should preserve null elements' ) }); test('arrays', function(t) { t.plan(3); var arr = [ 2 ]; t.equal( '[2]', safeJsonStringify(arr), 'should add array elements' ); arr.push(arr); t.equal( '[2,"[Circular]"]', safeJsonStringify(arr), 'should add array elements' ); t.equal( '{"x":[2,"[Circular]"]}', safeJsonStringify({x: arr}), 'should add array elements' ); }); test('throwing toJSON', function(t) { t.plan(2); var obj = { toJSON: function() { throw new Error('Failing'); } }; t.equal( '"[Throws: Failing]"', safeJsonStringify(obj), 'should not throw, just serialize to string' ); t.equal( '{"x":"[Throws: Failing]"}', safeJsonStringify({ x: obj }), 'should not throw, just serialize to string' ); }); test('properties on Object.create(null)', function(t) { t.plan(2); var obj = Object.create(null, { foo: { get: function() { return 'bar'; }, enumerable: true } }); t.equal( '{"foo":"bar"}', safeJsonStringify(obj), 'should return value of non-throwing getter' ); var obj = Object.create(null, { foo: { get: function() { return 'bar'; }, enumerable: true }, broken: { get: function() { throw new Error('Broken'); }, enumerable: true } }); t.equal( '{"foo":"bar","broken":"[Throws: Broken]"}', safeJsonStringify(obj), 'should return value of non-throwing getter' ); }); test('defined getter properties using __defineGetter__', function(t) { t.plan(3); // non throwing var obj = {}; obj.__defineGetter__('foo', function() { return 'bar'; }); t.equal( '{"foo":"bar"}', safeJsonStringify(obj), 'should return value of non-throwing getter' ); // throwing obj = {}; obj.__defineGetter__('foo', function() { return undefined['oh my']; }); t.doesNotThrow( function(){ safeJsonStringify(obj)}, 'should return throw if a getter throws an error' ); t.equal( '{"foo":"[Throws: Cannot read property \'oh my\' of undefined]"}', safeJsonStringify(obj), 'should return [Throws] when a getter throws an error' ); }); test('enumerable defined getter properties using Object.defineProperty', function(t) { t.plan(3); // non throwing var obj = {}; Object.defineProperty(obj, 'foo', {get: function() { return 'bar'; }, enumerable: true}); t.equal( '{"foo":"bar"}', safeJsonStringify(obj), 'should return value of non-throwing getter' ); // throwing obj = {}; Object.defineProperty(obj, 'foo', {get: function() { return undefined['oh my']; }, enumerable: true}); t.doesNotThrow( function(){ safeJsonStringify(obj)}, 'should return throw if a getter throws an error' ); t.equal( '{"foo":"[Throws: Cannot read property \'oh my\' of undefined]"}', safeJsonStringify(obj), 'should return [Throws] when a getter throws an error' ); }); test('formatting', function(t) { var obj = {a:{b:1, c:[{d: 1}]}}; // some nested object var formatters = [3, "\t", " "]; t.plan(formatters.length) formatters.forEach((formatter) => { t.equal( JSON.stringify(obj, null, formatter), safeJsonStringify(obj, null, formatter), 'should apply identical formatting as JSON.stringify itself' ); }); }); test('replacing', function(t) { var obj = {a:{b:1, c:[{d: 1}]}}; // some nested object var replacers = [ ["a", "c"], (k, v) => typeof v == 'number' ? "***" : v, () => undefined, [] ]; t.plan(replacers.length) replacers.forEach((replacer) => { t.equal( JSON.stringify(obj, replacer), safeJsonStringify(obj, replacer), 'should use replacer functionality the identical way as JSON.stringify itself' ); }); });