@zudojs/serialization 1.2.1 → 1.2.3

package/README.md

@@ -143,6 +143,11 @@ Failures throw `@zudojs/errors` serialization classes: `SerializationPayloadTooL
 or malformed tags under `strict`), `TransformerError` and `SerializeError` (for
 example an invalid `Date`). All extend `SerializationError`.
 
+An oversized string passed to `deserialize` is untrusted input, so its
+`SerializationPayloadTooLargeError` is an exposed 413 whose message names only
+the two sizes. Oversized output from `serialize` was built by the server, so
+it is an unexposed 500 that public error responses do not describe.
+
 ### Serialized errors
 
 Stack traces are **not** serialized unless you ask, because a serialized error

package/dist/serializerJson/jsonSerializer.core.js

@@ -63,7 +63,7 @@ export class JSONSerializer {
             const json = opts.pretty
                 ? JSON.stringify(transformed, null, opts.indent ?? 2)
                 : JSON.stringify(transformed);
-            assertByteSize(json, maxSize);
+            assertByteSize(json, maxSize, "output");
             return json;
         }
         // The fast path stays a bare `JSON.stringify` by default, but a depth
@@ -76,7 +76,7 @@ export class JSONSerializer {
         const json = opts.pretty
             ? JSON.stringify(value, null, opts.indent ?? 2)
             : JSON.stringify(value);
-        assertByteSize(json, maxSize);
+        assertByteSize(json, maxSize, "output");
         return json;
     }
     deserialize(value, options) {
@@ -86,7 +86,7 @@ export class JSONSerializer {
         // the string handed to `deserialize` arrives from a queue, an RPC peer, or
         // a request body.
         const maxSize = opts.maxSize ?? SerializationLimits.MAX_SIZE;
-        assertByteSize(value, maxSize);
+        assertByteSize(value, maxSize, "input");
         const parsed = this.parse(value);
         if (opts.preserveTypes === true) {
             const maxDepth = opts.maxDepth ?? SerializationLimits.MAX_DEPTH;

package/dist/serializerJson/jsonSerializer.keys.d.ts

@@ -3,11 +3,22 @@
  */
 /** Byte length of a string, in whichever runtime we are on. */
 export declare function byteLength(value: string): number;
+/**
+ * Error options for an oversized payload the server built itself (the
+ * output of `serialize`): an internal error that is never shown to the
+ * client. Oversized input to `deserialize` keeps the error's default, an
+ * exposed 413.
+ */
+export declare const SERVER_BUILT_PAYLOAD_ERROR: Readonly<{
+    statusCode: 500;
+    expose: false;
+}>;
 /**
  * Throws `SerializationPayloadTooLargeError` when a JSON string is larger
- * than `maxSize` bytes.
+ * than `maxSize` bytes. `origin` says whose payload it is: `"input"`
+ * (untrusted, an exposed 413) or `"output"` (server-built, an unexposed 500).
  */
-export declare function assertByteSize(json: string, maxSize: number): void;
+export declare function assertByteSize(json: string, maxSize: number, origin: "input" | "output"): void;
 /**
  * Assigns a key onto a freshly built object without invoking a setter.
  *

package/dist/serializerJson/jsonSerializer.keys.js

@@ -9,14 +9,28 @@ export function byteLength(value) {
         ? Buffer.byteLength(value, "utf-8")
         : new TextEncoder().encode(value).byteLength;
 }
+/**
+ * Error options for an oversized payload the server built itself (the
+ * output of `serialize`): an internal error that is never shown to the
+ * client. Oversized input to `deserialize` keeps the error's default, an
+ * exposed 413.
+ */
+export const SERVER_BUILT_PAYLOAD_ERROR = Object.freeze({
+    statusCode: 500,
+    expose: false,
+});
 /**
  * Throws `SerializationPayloadTooLargeError` when a JSON string is larger
- * than `maxSize` bytes.
+ * than `maxSize` bytes. `origin` says whose payload it is: `"input"`
+ * (untrusted, an exposed 413) or `"output"` (server-built, an unexposed 500).
  */
-export function assertByteSize(json, maxSize) {
+export function assertByteSize(json, maxSize, origin) {
     const size = byteLength(json);
-    if (size > maxSize)
-        throw new SerializationPayloadTooLargeError(size, maxSize);
+    if (size <= maxSize)
+        return;
+    throw origin === "output"
+        ? new SerializationPayloadTooLargeError(size, maxSize, SERVER_BUILT_PAYLOAD_ERROR)
+        : new SerializationPayloadTooLargeError(size, maxSize);
 }
 /**
  * Assigns a key onto a freshly built object without invoking a setter.

package/dist/serializerJson/jsonSerializer.restore.js

@@ -5,6 +5,7 @@
  * plain objects (see `jsonSerializer.escape.ts`).
  */
 import { InvalidSerializedDataError, SerializationDepthError, TransformerError, isSerializationError, } from "@zudojs/errors";
+import { UNTRUSTED_DEPTH_ERROR } from "@zudojs/validation";
 import { SerializationLimits, SerializationTags } from "@zudojs/constants";
 import { isPlainObject } from "@zudojs/types";
 import { escapedBody } from "./jsonSerializer.escape.js";
@@ -22,7 +23,10 @@ export function restoreValue(walk, value, depth) {
     if (value === null || typeof value !== "object")
         return value;
     if (depth >= walk.maxDepth) {
-        throw new SerializationDepthError(depth + 1, walk.maxDepth);
+        // The restore walk only runs in `deserialize`, on untrusted input, so a
+        // too-deep payload is the client's fault: an exposed 400, not a hidden
+        // 500 (the serialize-side walk keeps the server-error default).
+        throw new SerializationDepthError(depth + 1, walk.maxDepth, UNTRUSTED_DEPTH_ERROR);
     }
     if (Array.isArray(value)) {
         return value.map((item) => restoreValue(walk, item, depth + 1));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zudojs/serialization",
-  "version": "1.2.1",
+  "version": "1.2.3",
   "description": "Data translation layer with JSON serializer, type transformers, envelopes, and registry for Zudojs applications.",
   "type": "module",
   "main": "./dist/index.js",
@@ -19,10 +19,10 @@
     "LICENSE"
   ],
   "dependencies": {
-    "@zudojs/constants": "1.1.2",
-    "@zudojs/errors": "1.3.0",
+    "@zudojs/constants": "1.1.4",
+    "@zudojs/errors": "1.3.2",
     "@zudojs/types": "1.2.0",
-    "@zudojs/validation": "1.1.0"
+    "@zudojs/validation": "1.1.2"
   },
   "devDependencies": {
     "typescript": "7.0.2",