package/package.json000644 0000001631 3560116604 011547 0ustar00000000 000000 { "name": "serialize-javascript", "version": "1.7.0", "description": "Serialize JavaScript to a superset of JSON that includes regular expressions and functions.", "main": "index.js", "scripts": { "benchmark": "node -v && node test/benchmark/serialize.js", "test": "istanbul cover -- ./node_modules/mocha/bin/_mocha test/unit/ --reporter spec" }, "repository": { "type": "git", "url": "git+https://github.com/yahoo/serialize-javascript.git" }, "keywords": [ "serialize", "serialization", "javascript", "js", "json" ], "author": "Eric Ferraiuolo ", "license": "BSD-3-Clause", "bugs": { "url": "https://github.com/yahoo/serialize-javascript/issues" }, "homepage": "https://github.com/yahoo/serialize-javascript", "devDependencies": { "benchmark": "^2.1.4", "chai": "^4.1.0", "istanbul": "^0.4.5", "mocha": "^5.2.0" } } package/index.js000644 0000012565 3560116604 010736 0ustar00000000 000000 /* Copyright (c) 2014, Yahoo! Inc. All rights reserved. Copyrights licensed under the New BSD License. See the accompanying LICENSE file for terms. */ 'use strict'; // Generate an internal UID to make the regexp pattern harder to guess. var UID = Math.floor(Math.random() * 0x10000000000).toString(16); var PLACE_HOLDER_REGEXP = new RegExp('"@__(F|R|D|M|S)-' + UID + '-(\\d+)__@"', 'g'); var IS_NATIVE_CODE_REGEXP = /\{\s*\[native code\]\s*\}/g; var IS_PURE_FUNCTION = /function.*?\(/; var UNSAFE_CHARS_REGEXP = /[<>\/\u2028\u2029]/g; var RESERVED_SYMBOLS = ['*', 'async']; // Mapping of unsafe HTML and invalid JavaScript line terminator chars to their // Unicode char counterparts which are safe to use in JavaScript strings. var ESCAPED_CHARS = { '<' : '\\u003C', '>' : '\\u003E', '/' : '\\u002F', '\u2028': '\\u2028', '\u2029': '\\u2029' }; function escapeUnsafeChars(unsafeChar) { return ESCAPED_CHARS[unsafeChar]; } module.exports = function serialize(obj, options) { options || (options = {}); // Backwards-compatibility for `space` as the second argument. if (typeof options === 'number' || typeof options === 'string') { options = {space: options}; } var functions = []; var regexps = []; var dates = []; var maps = []; var sets = []; // Returns placeholders for functions and regexps (identified by index) // which are later replaced by their string representation. function replacer(key, value) { if (!value) { return value; } // If the value is an object w/ a toJSON method, toJSON is called before // the replacer runs, so we use this[key] to get the non-toJSONed value. var origValue = this[key]; var type = typeof origValue; if (type === 'object') { if(origValue instanceof RegExp) { return '@__R-' + UID + '-' + (regexps.push(origValue) - 1) + '__@'; } if(origValue instanceof Date) { return '@__D-' + UID + '-' + (dates.push(origValue) - 1) + '__@'; } if(origValue instanceof Map) { return '@__M-' + UID + '-' + (maps.push(origValue) - 1) + '__@'; } if(origValue instanceof Set) { return '@__S-' + UID + '-' + (sets.push(origValue) - 1) + '__@'; } } if (type === 'function') { return '@__F-' + UID + '-' + (functions.push(origValue) - 1) + '__@'; } return value; } function serializeFunc(fn) { var serializedFn = fn.toString(); if (IS_NATIVE_CODE_REGEXP.test(serializedFn)) { throw new TypeError('Serializing native function: ' + fn.name); } // pure functions, example: {key: function() {}} if(IS_PURE_FUNCTION.test(serializedFn)) { return serializedFn; } var argsStartsAt = serializedFn.indexOf('('); var def = serializedFn.substr(0, argsStartsAt) .trim() .split(' ') .filter(function(val) { return val.length > 0 }); var nonReservedSymbols = def.filter(function(val) { return RESERVED_SYMBOLS.indexOf(val) === -1 }); // enhanced literal objects, example: {key() {}} if(nonReservedSymbols.length > 0) { return (def.indexOf('async') > -1 ? 'async ' : '') + 'function' + (def.join('').indexOf('*') > -1 ? '*' : '') + serializedFn.substr(argsStartsAt); } // arrow functions return serializedFn; } var str; // Creates a JSON string representation of the value. // NOTE: Node 0.12 goes into slow mode with extra JSON.stringify() args. if (options.isJSON && !options.space) { str = JSON.stringify(obj); } else { str = JSON.stringify(obj, options.isJSON ? null : replacer, options.space); } // Protects against `JSON.stringify()` returning `undefined`, by serializing // to the literal string: "undefined". if (typeof str !== 'string') { return String(str); } // Replace unsafe HTML and invalid JavaScript line terminator chars with // their safe Unicode char counterpart. This _must_ happen before the // regexps and functions are serialized and added back to the string. if (options.unsafe !== true) { str = str.replace(UNSAFE_CHARS_REGEXP, escapeUnsafeChars); } if (functions.length === 0 && regexps.length === 0 && dates.length === 0 && maps.length === 0 && sets.length === 0) { return str; } // Replaces all occurrences of function, regexp, date, map and set placeholders in the // JSON string with their string representations. If the original value can // not be found, then `undefined` is used. return str.replace(PLACE_HOLDER_REGEXP, function (match, type, valueIndex) { if (type === 'D') { return "new Date(\"" + dates[valueIndex].toISOString() + "\")"; } if (type === 'R') { return regexps[valueIndex].toString(); } if (type === 'M') { return "new Map(" + serialize(Array.from(maps[valueIndex].entries()), options) + ")"; } if (type === 'S') { return "new Set(" + serialize(Array.from(sets[valueIndex].values()), options) + ")"; } var fn = functions[valueIndex]; return serializeFunc(fn); }); } package/LICENSE000644 0000002716 3560116604 010273 0ustar00000000 000000 Copyright 2014 Yahoo! Inc. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. * Neither the name of the Yahoo! Inc. nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL YAHOO! INC. BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. package/README.md000644 0000012515 3560116604 010543 0ustar00000000 000000 Serialize JavaScript ==================== Serialize JavaScript to a _superset_ of JSON that includes regular expressions, dates and functions. [![npm Version][npm-badge]][npm] [![Dependency Status][david-badge]][david] [![Build Status][travis-badge]][travis] ## Overview The code in this package began its life as an internal module to [express-state][]. To expand its usefulness, it now lives as `serialize-javascript` — an independent package on npm. You're probably wondering: **What about `JSON.stringify()`!?** We've found that sometimes we need to serialize JavaScript **functions**, **regexps**, **dates**, **sets** or **maps**. A great example is a web app that uses client-side URL routing where the route definitions are regexps that need to be shared from the server to the client. But this module is also great for communicating between node processes. The string returned from this package's single export function is literal JavaScript which can be saved to a `.js` file, or be embedded into an HTML document by making the content of a `' }); ``` The above will produce the following string, HTML-escaped output which is safe to put into an HTML document as it will not cause the inline script element to terminate: ```js '{"haxorXSS":"\\u003C\\u002Fscript\\u003E"}' ``` > You can pass an optional `unsafe` argument to `serialize()` for straight serialization. ### Options The `serialize()` function accepts an `options` object as its second argument. All options are being defaulted to `undefined`: #### `options.space` This option is the same as the `space` argument that can be passed to [`JSON.stringify`][JSON.stringify]. It can be used to add whitespace and indentation to the serialized output to make it more readable. ```js serialize(obj, {space: 2}); ``` #### `options.isJSON` This option is a signal to `serialize()` that the object being serialized does not contain any function or regexps values. This enables a hot-path that allows serialization to be over 3x faster. If you're serializing a lot of data, and know its pure JSON, then you can enable this option for a speed-up. **Note:** That when using this option, the output will still be escaped to protect against XSS. ```js serialize(obj, {isJSON: true}); ``` #### `options.unsafe` This option is to signal `serialize()` that we want to do a straight conversion, without the XSS protection. This options needs to be explicitly set to `true`. HTML characters and JavaScript line terminators will not be escaped. You will have to roll your own. ```js serialize(obj, {unsafe: true}); ``` ## Deserializing For some use cases you might also need to deserialize the string. This is explicitly not part of this module. However, you can easily write it yourself: ```js function deserialize(serializedJavascript){ return eval('(' + serializedJavascript + ')'); } ``` **Note:** Don't forget the parentheses around the serialized javascript, as the opening bracket `{` will be considered to be the start of a body. ## License This software is free to use under the Yahoo! Inc. BSD license. See the [LICENSE file][LICENSE] for license text and copyright information. [npm]: https://www.npmjs.org/package/serialize-javascript [npm-badge]: https://img.shields.io/npm/v/serialize-javascript.svg?style=flat-square [david]: https://david-dm.org/yahoo/serialize-javascript [david-badge]: https://img.shields.io/david/yahoo/serialize-javascript.svg?style=flat-square [travis]: https://travis-ci.org/yahoo/serialize-javascript [travis-badge]: https://img.shields.io/travis/yahoo/serialize-javascript.svg?style=flat-square [express-state]: https://github.com/yahoo/express-state [JSON.stringify]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/JSON/stringify [LICENSE]: https://github.com/yahoo/serialize-javascript/blob/master/LICENSE