fast-json-stringify 5.12.0 → 5.13.0

package/README.md

@@ -630,6 +630,24 @@ integer-like values, such as:
 - `'2e4'` - _note this will be converted to `2`, not `20000`_
 - `1.5` - _note this will be converted to `1`_
 
+<a name="unsafe"></a>
+#### Unsafe string
+By default, the library escapes all strings. With the 'unsafe' format, the string isn't escaped. This has a potentially dangerous security issue. You can use it only if you are sure that your data doesn't need escaping. The advantage is a significant performance improvement.
+
+Example:
+```javascript
+const stringify = fastJson({
+  title: 'Example Schema',
+  type: 'object',
+  properties: {
+    'code': {
+	    type: 'string',
+	    format 'unsafe'
+    }
+  }
+})
+```
+
 ##### Benchmarks
 
 For reference, here goes some benchmarks for comparison over the three

package/benchmark/bench.js

@@ -47,6 +47,14 @@ const benchmarks = [
     },
     input: 'hello world'
   },
+  {
+    name: 'unsafe short string',
+    schema: {
+      type: 'string',
+      format: 'unsafe'
+    },
+    input: 'hello world'
+  },
   {
     name: 'short string with double quote',
     schema: {
@@ -61,6 +69,14 @@ const benchmarks = [
     },
     input: longSimpleString
   },
+  {
+    name: 'unsafe long string without double quotes',
+    schema: {
+      type: 'string',
+      format: 'unsafe'
+    },
+    input: longSimpleString
+  },
   {
     name: 'long string',
     schema: {
@@ -68,6 +84,14 @@ const benchmarks = [
     },
     input: longString
   },
+  {
+    name: 'unsafe long string',
+    schema: {
+      type: 'string',
+      format: 'unsafe'
+    },
+    input: longString
+  },
   {
     name: 'number',
     schema: {

package/index.js

@@ -725,8 +725,24 @@ function buildSingleTypeSerializer (context, location, input) {
         return `json += serializer.asDate(${input})`
       } else if (schema.format === 'time') {
         return `json += serializer.asTime(${input})`
+      } else if (schema.format === 'unsafe') {
+        return `json += serializer.asUnsafeString(${input})`
       } else {
-        return `json += serializer.asString(${input})`
+        return `
+        if (typeof ${input} !== 'string') {
+          if (${input} === null) {
+            json += '""'
+          } else if (${input} instanceof Date) {
+            json += '"' + ${input}.toISOString() + '"'
+          } else if (${input} instanceof RegExp) {
+            json += serializer.asString(${input}.source)
+          } else {
+            json += serializer.asString(${input}.toString())
+          }
+        } else {
+          json += serializer.asString(${input})
+        }
+        `
       }
     }
     case 'integer':

package/lib/serializer.js

@@ -99,29 +99,20 @@ module.exports = class Serializer {
   }
 
   asString (str) {
-    if (typeof str !== 'string') {
-      if (str === null) {
-        return '""'
-      }
-      if (str instanceof Date) {
-        return '"' + str.toISOString() + '"'
-      }
-      if (str instanceof RegExp) {
-        str = str.source
-      } else {
-        str = str.toString()
-      }
-    }
-
     if (str.length < 42) {
       return this.asStringSmall(str)
-    } else if (STR_ESCAPE.test(str) === false) {
+    } else if (str.length < 5000 && STR_ESCAPE.test(str) === false) {
+      // Only use the regular expression for shorter input. The overhead is otherwise too much.
       return '"' + str + '"'
     } else {
       return JSON.stringify(str)
     }
   }
 
+  asUnsafeString (str) {
+    return '"' + str + '"'
+  }
+
   // magically escape strings for json
   // relying on their charCodeAt
   // everything below 32 needs JSON.stringify()
@@ -137,11 +128,8 @@ module.exports = class Serializer {
     // eslint-disable-next-line
     for (var i = 0; i < len; i++) {
       point = str.charCodeAt(i)
-      if (point < 32) {
-        return JSON.stringify(str)
-      }
-      if (point >= 0xD800 && point <= 0xDFFF) {
-        // The current character is a surrogate.
+      if (point < 32 || (point >= 0xD800 && point <= 0xDFFF)) {
+        // The current character is non-printable characters or a surrogate.
         return JSON.stringify(str)
       }
       if (

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fast-json-stringify",
-  "version": "5.12.0",
+  "version": "5.13.0",
   "description": "Stringify your JSON at max speed",
   "main": "index.js",
   "type": "commonjs",

package/test/basic.test.js

@@ -18,6 +18,12 @@ function buildTest (schema, toStringify) {
   })
 }
 
+buildTest({
+  title: 'string',
+  type: 'string',
+  format: 'unsafe'
+}, 'hello world')
+
 buildTest({
   title: 'basic',
   type: 'object',

package/test/string.test.js

@@ -48,3 +48,37 @@ test('serialize long string', (t) => {
   t.equal(output, `"${new Array(2e4).fill('\\u0000').join('')}"`)
   t.equal(JSON.parse(output), input)
 })
+
+test('unsafe string', (t) => {
+  t.plan(2)
+
+  const schema = {
+    type: 'string',
+    format: 'unsafe'
+  }
+
+  const input = 'abcd'
+  const stringify = build(schema)
+  const output = stringify(input)
+
+  t.equal(output, `"${input}"`)
+  t.equal(JSON.parse(output), input)
+})
+
+test('unsafe unescaped string', (t) => {
+  t.plan(2)
+
+  const schema = {
+    type: 'string',
+    format: 'unsafe'
+  }
+
+  const input = 'abcd "abcd"'
+  const stringify = build(schema)
+  const output = stringify(input)
+
+  t.equal(output, `"${input}"`)
+  t.throws(function () {
+    JSON.parse(output)
+  })
+})

package/types/index.d.ts

@@ -208,6 +208,9 @@ interface StandaloneOption extends build.Options {
   mode: 'standalone'
 }
 
+type StringCoercible = string | Date | RegExp;
+type IntegerCoercible = number | BigInt;
+
 /**
  * Build a stringify function using a schema of the documents that should be stringified
  * @param schema The schema used to stringify values
@@ -217,8 +220,8 @@ declare function build(schema: build.AnySchema, options: DebugOption): { code: s
 declare function build(schema: build.AnySchema, options: DeprecateDebugOption): { code: string, ajv: Ajv };
 declare function build(schema: build.AnySchema, options: StandaloneOption): string;
 declare function build(schema: build.AnySchema, options?: build.Options): <TDoc = any>(doc: TDoc) => any;
-declare function build(schema: build.StringSchema, options?: build.Options): <TDoc extends string = string>(doc: TDoc) => string;
-declare function build(schema: build.IntegerSchema | build.NumberSchema, options?: build.Options): <TDoc extends number = number>(doc: TDoc) => string;
+declare function build(schema: build.StringSchema, options?: build.Options): <TDoc extends StringCoercible = StringCoercible>(doc: TDoc) => string;
+declare function build(schema: build.IntegerSchema | build.NumberSchema, options?: build.Options): <TDoc extends IntegerCoercible = IntegerCoercible>(doc: TDoc) => string;
 declare function build(schema: build.NullSchema, options?: build.Options): <TDoc extends null = null>(doc: TDoc) => "null";
 declare function build(schema: build.BooleanSchema, options?: build.Options): <TDoc extends boolean = boolean>(doc: TDoc) => string;
 declare function build(schema: build.ArraySchema | build.TupleSchema, options?: build.Options): <TDoc extends any[]= any[]>(doc: TDoc) => string;

package/types/index.test-d.ts

@@ -3,61 +3,62 @@ import build, { restore, Schema, validLargeArrayMechanisms } from '..'
 import { expectError, expectType } from 'tsd'
 
 // Number schemas
-const schema1: Schema = {
+build({
     type: 'number'
-}
-const schema2: Schema = {
+})(25)
+build({
     type: 'integer'
-}
-
-build(schema1)(25)
-build(schema2)(-5)
+})(-5)
+build({
+    type: 'integer'
+})(5n)
 
-build(schema2, { rounding: 'ceil' })
-build(schema2, { rounding: 'floor' })
-build(schema2, { rounding: 'round' })
-build(schema2, { rounding: 'trunc' })
-expectError(build(schema2, { rounding: 'invalid' }))
+build({
+    type: 'number'
+}, { rounding: 'ceil' })
+build({
+    type: 'number'
+}, { rounding: 'floor' })
+build({
+    type: 'number'
+}, { rounding: 'round' })
+build({
+    type: 'number'
+}, { rounding: 'trunc' })
+expectError(build({
+    type: 'number'
+}, { rounding: 'invalid' }))
 
 // String schema
-const schema3: Schema = {
-    type: 'string'
-}
-
-build(schema3)('foobar')
+build({
+  type: 'string'
+})('foobar')
 
 // Boolean schema
-const schema4: Schema = {
+build({
     type: 'boolean'
-}
-
-build(schema4)(true)
+})(true)
 
 // Null schema
-const schema5: Schema = {
+build({
     type: 'null'
-}
-
-build(schema5)(null)
+})(null)
 
 // Array schemas
-const schema6: Schema = {
+build({
     type: 'array',
     items: { type: 'number' }
-}
-const schema7: Schema = {
+})([25])
+build({
     type: 'array',
     items: [{ type: 'string'}, {type: 'integer'}]
-}
-
-build(schema6)([25])
-build(schema7)(['hello', 42])
+})(['hello', 42])
 
 // Object schemas
-const schema8: Schema = {
+build({
     type: 'object'
-}
-const schema9: Schema = {
+})({})
+build({
     type: 'object',
     properties: {
         foo: { type: 'string' },
@@ -70,14 +71,24 @@ const schema9: Schema = {
     additionalProperties: {
       type: 'boolean'
     }
-}
-
-build(schema8)({})
-build(schema9)({ foo: 'bar' })
-build(schema9, { rounding: 'floor' })({ foo: 'bar' })
+})({ foo: 'bar' })
+build({
+    type: 'object',
+    properties: {
+        foo: { type: 'string' },
+        bar: { type: 'integer' }
+    },
+    required: ['foo'],
+    patternProperties: {
+      'baz*': { type: 'null' }
+    },
+    additionalProperties: {
+      type: 'boolean'
+    }
+}, { rounding: 'floor' })({ foo: 'bar' })
 
 // Reference schemas
-const schema10: Schema = {
+build({
   title: 'Example Schema',
   definitions: {
     num: {
@@ -109,12 +120,10 @@ const schema10: Schema = {
   additionalProperties: {
     $ref: '#/definitions/def'
   }
-}
-
-build(schema10)({ nickname: '', num: { int: 5 }, other: null })
+})({ nickname: '', num: { int: 5 }, other: null })
 
 // Conditional/Combined schemas
-const schema11: Schema = {
+build({
   title: 'Conditional/Combined Schema',
   type: 'object',
   properties: {
@@ -140,24 +149,37 @@ const schema11: Schema = {
       somethingElse: { type: 'null' }
     }
   }
-}
-
-build(schema11)({ something: 'a string', somethingElse: 42 })
+})({ something: 'a string', somethingElse: 42 })
 
 // String schema with format
-const schema12: Schema = {
+
+build({
   type: 'string',
   format: 'date-time'
-}
-
-build(schema12)(new Date())
+})(new Date())
 
+/*
+This overload doesn't work yet - 
+TypeScript chooses the generic for the schema
+before it chooses the overload for the options
+parameter.
 let str: string, ajv: Ajv
-str = build(schema1, { debugMode: true }).code
-ajv = build(schema1, { debugMode: true }).ajv
-str = build(schema1, { mode: 'debug' }).code
-ajv = build(schema1, { mode: 'debug' }).ajv
-str = build(schema1, { mode: 'standalone' })
+str = build({
+    type: 'number'
+}, { debugMode: true }).code
+ajv = build({
+    type: 'number'
+}, { debugMode: true }).ajv
+str = build({
+    type: 'number'
+}, { mode: 'debug' }).code
+ajv = build({
+    type: 'number'
+}, { mode: 'debug' }).ajv
+str = build({
+    type: 'number'
+}, { mode: 'standalone' })
+*/
 
 const debugCompiled = build({
   title: 'default string',