@wooksjs/http-body 0.7.26 → 0.7.28
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.cjs +7 -1
- package/dist/index.mjs +7 -1
- package/package.json +5 -5
package/dist/index.cjs
CHANGED
|
@@ -9,9 +9,15 @@ const ILLEGAL_KEYS = [
|
|
|
9
9
|
"constructor",
|
|
10
10
|
"prototype"
|
|
11
11
|
];
|
|
12
|
+
/**
|
|
13
|
+
* `JSON.parse` that rejects `__proto__` / `constructor` / `prototype` keys (400).
|
|
14
|
+
*
|
|
15
|
+
* A parsed key can only spell an illegal name when the source contains that name literally
|
|
16
|
+
* or uses a `\u` escape, so the key walk is skipped for sources that contain neither.
|
|
17
|
+
*/
|
|
12
18
|
function safeJsonParse(src) {
|
|
13
19
|
const parsed = JSON.parse(src);
|
|
14
|
-
assertNoProtoKeys(parsed);
|
|
20
|
+
if (src.includes("__proto__") || src.includes("constructor") || src.includes("prototype") || src.includes("\\u")) assertNoProtoKeys(parsed);
|
|
15
21
|
return parsed;
|
|
16
22
|
}
|
|
17
23
|
function assertNoProtoKeys(obj) {
|
package/dist/index.mjs
CHANGED
|
@@ -8,9 +8,15 @@ const ILLEGAL_KEYS = [
|
|
|
8
8
|
"constructor",
|
|
9
9
|
"prototype"
|
|
10
10
|
];
|
|
11
|
+
/**
|
|
12
|
+
* `JSON.parse` that rejects `__proto__` / `constructor` / `prototype` keys (400).
|
|
13
|
+
*
|
|
14
|
+
* A parsed key can only spell an illegal name when the source contains that name literally
|
|
15
|
+
* or uses a `\u` escape, so the key walk is skipped for sources that contain neither.
|
|
16
|
+
*/
|
|
11
17
|
function safeJsonParse(src) {
|
|
12
18
|
const parsed = JSON.parse(src);
|
|
13
|
-
assertNoProtoKeys(parsed);
|
|
19
|
+
if (src.includes("__proto__") || src.includes("constructor") || src.includes("prototype") || src.includes("\\u")) assertNoProtoKeys(parsed);
|
|
14
20
|
return parsed;
|
|
15
21
|
}
|
|
16
22
|
function assertNoProtoKeys(obj) {
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@wooksjs/http-body",
|
|
3
|
-
"version": "0.7.
|
|
3
|
+
"version": "0.7.28",
|
|
4
4
|
"description": "@wooksjs/http-body",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"api",
|
|
@@ -42,12 +42,12 @@
|
|
|
42
42
|
"devDependencies": {
|
|
43
43
|
"typescript": "^5.9.3",
|
|
44
44
|
"vitest": "^3.2.7",
|
|
45
|
-
"@wooksjs/event-
|
|
46
|
-
"@wooksjs/event-
|
|
45
|
+
"@wooksjs/event-http": "^0.7.28",
|
|
46
|
+
"@wooksjs/event-core": "^0.7.28"
|
|
47
47
|
},
|
|
48
48
|
"peerDependencies": {
|
|
49
|
-
"@wooksjs/event-
|
|
50
|
-
"@wooksjs/event-
|
|
49
|
+
"@wooksjs/event-core": "^0.7.28",
|
|
50
|
+
"@wooksjs/event-http": "^0.7.28"
|
|
51
51
|
},
|
|
52
52
|
"scripts": {
|
|
53
53
|
"build": "rolldown -c ../../rolldown.config.mjs"
|