Repository navigation
fix: ignore options inherited from Object.prototype - #239
Open
kuldeepsinh19 wants to merge 1 commit into
Open
kuldeepsinh19 wants to merge 1 commit into
kuldeepsinh19 wants to merge 1 commit into
Conversation
serialize() read its options with plain property access, so a value set on Object.prototype (e.g. unsafe) applied to every call and could turn off HTML escaping. Only own properties of the options object are used now. Fixes yahoo#230
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #230.
serialize()reads its options with plain property access, so a value inherited fromObject.prototypecounts the same as one the caller passed. If anything else in the process setsObject.prototype.unsafe, every call skips HTML escaping, including calls with no options. The same applies toisJSON,ignoreFunctionandspace.serialize()now copies the four options it knows into a null-prototype object, and only when they are own properties of what the caller passed. Everything after that, including the recursive calls for Maps, Sets, arrays and URLs and the function-body escaping, reads from that copy. Explicit options ({unsafe: true}, a null-prototype options object,spacegiven as a number or string) behave as before.One behaviour change: an options object that gets its values only through a custom prototype (for example
Object.create({unsafe: true})) is no longer honoured. Neither the README nor the tests use options that way.The new test serializes a value containing
</script>in a string, a function body and a Map, with all four options set onObject.prototype, and checks the output is identical to the unpolluted output. It fails without the change inindex.js(3 of 3 runs) and passes with it. All 120 tests pass (npm test, Node 24).This change was written with help from an AI coding assistant (Claude Code).