seroval 1.6.1 → 1.6.3

package/dist/index.js

@@ -196,6 +196,94 @@ function deserializeString(str) {
 	return str.replace(/(\\\\|\\"|\\n|\\r|\\b|\\t|\\f|\\u2028|\\u2029|\\x3C)/g, deserializeReplacer);
 }
 //#endregion
+//#region src/core/errors.ts
+const { toString: objectToString } = Object.prototype;
+const STEP_ERROR_CODES = {
+	parsing: 1,
+	serialization: 2,
+	deserialization: 3
+};
+function getErrorMessageProd(type) {
+	return `Seroval Error (step: ${STEP_ERROR_CODES[type]})`;
+}
+const getErrorMessage = (type, cause) => getErrorMessageProd(type);
+var SerovalError = class extends Error {
+	constructor(type, cause) {
+		super(getErrorMessage(type, cause));
+		this.cause = cause;
+	}
+};
+var SerovalParserError = class extends SerovalError {
+	constructor(cause) {
+		super("parsing", cause);
+	}
+};
+var SerovalSerializationError = class extends SerovalError {
+	constructor(cause) {
+		super("serialization", cause);
+	}
+};
+var SerovalDeserializationError = class extends SerovalError {
+	constructor(cause) {
+		super("deserialization", cause);
+	}
+};
+function getSpecificErrorMessage(code) {
+	return `Seroval Error (specific: ${code})`;
+}
+var SerovalUnsupportedTypeError = class extends Error {
+	constructor(value) {
+		super(getSpecificErrorMessage(1));
+		this.value = value;
+	}
+};
+var SerovalUnsupportedNodeError = class extends Error {
+	constructor(node) {
+		super(getSpecificErrorMessage(2));
+	}
+};
+var SerovalMissingPluginError = class extends Error {
+	constructor(tag) {
+		super(getSpecificErrorMessage(3));
+	}
+};
+var SerovalMissingInstanceError = class extends Error {
+	constructor(tag) {
+		super(getSpecificErrorMessage(4));
+	}
+};
+var SerovalMissingReferenceError = class extends Error {
+	constructor(value) {
+		super(getSpecificErrorMessage(5));
+		this.value = value;
+	}
+};
+var SerovalMissingReferenceForIdError = class extends Error {
+	constructor(id) {
+		super(getSpecificErrorMessage(6));
+	}
+};
+var SerovalUnknownTypedArrayError = class extends Error {
+	constructor(name) {
+		super(getSpecificErrorMessage(7));
+	}
+};
+var SerovalMalformedNodeError = class extends Error {
+	constructor(node) {
+		super(getSpecificErrorMessage(8));
+	}
+};
+var SerovalConflictedNodeIdError = class extends Error {
+	constructor(node) {
+		super(getSpecificErrorMessage(9));
+	}
+};
+var SerovalDepthLimitError = class extends Error {
+	constructor(limit) {
+		super(getSpecificErrorMessage(9));
+	}
+};
+//#endregion
 //#region src/core/keys.ts
 const REFERENCES_KEY = "__SEROVAL_REFS__";
 const GLOBAL_CONTEXT_R = `self.\$R`;
@@ -272,14 +360,16 @@ function getErrorOptions(error, features) {
 	const names = Object.getOwnPropertyNames(error);
 	for (let i = 0, len = names.length, name; i < len; i++) {
 		name = names[i];
-		if (name !== "name" && name !== "message") if (name === "stack") {
-			if (features & 4) {
+		if (name !== "name" && name !== "message") {
+			if (name === "stack") {
+				if (features & 4) {
+					options = options || {};
+					options[name] = error[name];
+				}
+			} else {
 				options = options || {};
 				options[name] = error[name];
 			}
-		} else {
-			options = options || {};
-			options[name] = error[name];
 		}
 	}
 	return options;
@@ -337,13 +427,17 @@ function createArrayNode(id, current, parsedItems) {
 function createBoxedNode(id, boxed) {
 	return createSerovalNode(21, id, void 0, void 0, void 0, void 0, void 0, void 0, boxed, void 0, void 0, void 0);
 }
+const MAX_TYPED_ARRAY_LENGTH = 1e6;
 function createTypedArrayNode(id, current, buffer) {
+	if (current.length > MAX_TYPED_ARRAY_LENGTH) throw new SerovalUnsupportedTypeError(current);
 	return createSerovalNode(15, id, void 0, current.constructor.name, void 0, void 0, void 0, void 0, buffer, current.byteOffset, void 0, current.length);
 }
 function createBigIntTypedArrayNode(id, current, buffer) {
+	if (current.length > MAX_TYPED_ARRAY_LENGTH) throw new SerovalUnsupportedTypeError(current);
 	return createSerovalNode(16, id, void 0, current.constructor.name, void 0, void 0, void 0, void 0, buffer, current.byteOffset, void 0, current.length);
 }
 function createDataViewNode(id, current, buffer) {
+	if (current.byteLength > MAX_TYPED_ARRAY_LENGTH) throw new SerovalUnsupportedTypeError(current);
 	return createSerovalNode(20, id, void 0, void 0, void 0, void 0, void 0, void 0, buffer, current.byteOffset, void 0, current.byteLength);
 }
 function createErrorNode(id, current, options) {
@@ -377,94 +471,6 @@ function createSequenceNode(id, sequence, throwAt, doneAt) {
 	return createSerovalNode(35, id, throwAt, void 0, void 0, void 0, void 0, sequence, void 0, void 0, void 0, doneAt);
 }
 //#endregion
-//#region src/core/errors.ts
-const { toString: objectToString } = Object.prototype;
-const STEP_ERROR_CODES = {
-	parsing: 1,
-	serialization: 2,
-	deserialization: 3
-};
-function getErrorMessageProd(type) {
-	return `Seroval Error (step: ${STEP_ERROR_CODES[type]})`;
-}
-const getErrorMessage = (type, cause) => getErrorMessageProd(type);
-var SerovalError = class extends Error {
-	constructor(type, cause) {
-		super(getErrorMessage(type, cause));
-		this.cause = cause;
-	}
-};
-var SerovalParserError = class extends SerovalError {
-	constructor(cause) {
-		super("parsing", cause);
-	}
-};
-var SerovalSerializationError = class extends SerovalError {
-	constructor(cause) {
-		super("serialization", cause);
-	}
-};
-var SerovalDeserializationError = class extends SerovalError {
-	constructor(cause) {
-		super("deserialization", cause);
-	}
-};
-function getSpecificErrorMessage(code) {
-	return `Seroval Error (specific: ${code})`;
-}
-var SerovalUnsupportedTypeError = class extends Error {
-	constructor(value) {
-		super(getSpecificErrorMessage(1));
-		this.value = value;
-	}
-};
-var SerovalUnsupportedNodeError = class extends Error {
-	constructor(node) {
-		super(getSpecificErrorMessage(2));
-	}
-};
-var SerovalMissingPluginError = class extends Error {
-	constructor(tag) {
-		super(getSpecificErrorMessage(3));
-	}
-};
-var SerovalMissingInstanceError = class extends Error {
-	constructor(tag) {
-		super(getSpecificErrorMessage(4));
-	}
-};
-var SerovalMissingReferenceError = class extends Error {
-	constructor(value) {
-		super(getSpecificErrorMessage(5));
-		this.value = value;
-	}
-};
-var SerovalMissingReferenceForIdError = class extends Error {
-	constructor(id) {
-		super(getSpecificErrorMessage(6));
-	}
-};
-var SerovalUnknownTypedArrayError = class extends Error {
-	constructor(name) {
-		super(getSpecificErrorMessage(7));
-	}
-};
-var SerovalMalformedNodeError = class extends Error {
-	constructor(node) {
-		super(getSpecificErrorMessage(8));
-	}
-};
-var SerovalConflictedNodeIdError = class extends Error {
-	constructor(node) {
-		super(getSpecificErrorMessage(9));
-	}
-};
-var SerovalDepthLimitError = class extends Error {
-	constructor(limit) {
-		super(getSpecificErrorMessage(9));
-	}
-};
-//#endregion
 //#region src/core/opaque-reference.ts
 /**
 * An opaque reference allows hiding values from the serializer.
@@ -1052,7 +1058,6 @@ async function parseObjectAsync(ctx, depth, id, current) {
 		case DataView: return parseDataView$1(ctx, depth, id, current);
 		case Map: return parseMap$1(ctx, depth, id, current);
 		case Set: return parseSet$1(ctx, depth, id, current);
-		default: break;
 	}
 	if (currentClass === Promise || current instanceof Promise) return parsePromise$1(ctx, depth, id, current);
 	const currentFeatures = ctx.base.features;
@@ -1060,7 +1065,6 @@ async function parseObjectAsync(ctx, depth, id, current) {
 	if (currentFeatures & 16) switch (currentClass) {
 		case BigInt64Array:
 		case BigUint64Array: return parseBigIntTypedArray$1(ctx, depth, id, current);
-		default: break;
 	}
 	if (currentFeatures & 1 && typeof AggregateError !== "undefined" && (currentClass === AggregateError || current instanceof AggregateError)) return parseAggregateError$1(ctx, depth, id, current);
 	if (currentFeatures & 64 && typeof Temporal !== "undefined") switch (currentClass) {
@@ -1072,7 +1076,6 @@ async function parseObjectAsync(ctx, depth, id, current) {
 		case Temporal.PlainTime: return createTemporalNode(id, 5, current);
 		case Temporal.PlainYearMonth: return createTemporalNode(id, 6, current);
 		case Temporal.ZonedDateTime: return createTemporalNode(id, 7, current);
-		default: break;
 	}
 	if (current instanceof Error) return parseError$1(ctx, depth, id, current);
 	if (SYM_ITERATOR in current || SYM_ASYNC_ITERATOR in current) return parsePlainObject$1(ctx, depth, id, current, !!currentClass);
@@ -1235,6 +1238,9 @@ function guardIndexedValue(ctx, id) {
 	});
 	if (ctx.refs.has(id)) throw new Error("Conflicted ref id: " + id);
 }
+function isThennable(value) {
+	return !!value && typeof value === "object" && "then" in value && typeof value.then === "function";
+}
 function assignIndexedValueVanilla(ctx, id, value) {
 	guardIndexedValue(ctx.base, id);
 	if (ctx.state.marked.has(id)) ctx.base.refs.set(id, value);
@@ -1369,14 +1375,14 @@ function deserializeTypedArray(ctx, depth, node) {
 	const construct = getTypedArrayConstructor(node.c);
 	const source = deserialize$1(ctx, depth, node.f);
 	const offset = (_node$b = node.b) !== null && _node$b !== void 0 ? _node$b : 0;
-	if (offset < 0 || offset > source.byteLength) throw new SerovalMalformedNodeError(node);
+	if (offset < 0 || offset > source.byteLength || node.l > MAX_BASE64_LENGTH) throw new SerovalMalformedNodeError(node);
 	return assignIndexedValue$1(ctx, node.i, new construct(source, offset, node.l));
 }
 function deserializeDataView(ctx, depth, node) {
 	var _node$b2;
 	const source = deserialize$1(ctx, depth, node.f);
 	const offset = (_node$b2 = node.b) !== null && _node$b2 !== void 0 ? _node$b2 : 0;
-	if (offset < 0 || offset > source.byteLength) throw new SerovalMalformedNodeError(node);
+	if (offset < 0 || offset > source.byteLength || node.l > MAX_BASE64_LENGTH) throw new SerovalMalformedNodeError(node);
 	return assignIndexedValue$1(ctx, node.i, new DataView(source, offset, node.l));
 }
 function deserializeDictionary(ctx, depth, node, result) {
@@ -1397,6 +1403,7 @@ function deserializePromise(ctx, depth, node) {
 	const deferred = PROMISE_CONSTRUCTOR();
 	const result = assignIndexedValue$1(ctx, node.i, deferred.p);
 	const deserialized = deserialize$1(ctx, depth, node.f);
+	if (isThennable(deserialized)) throw new SerovalMalformedNodeError(node.f);
 	if (node.s) deferred.s(deserialized);
 	else deferred.f(deserialized);
 	return result;
@@ -1420,20 +1427,14 @@ function deserializePromiseConstructor(ctx, node) {
 	assignNodeType(ctx, node.s, 22);
 	return value;
 }
-function deserializePromiseResolve(ctx, depth, node) {
+function deserializePromiseFulfill(ctx, depth, node) {
 	const deferred = ctx.base.refs.get(node.i);
 	if (deferred) {
 		validateNodeType(ctx, node, node.i, 22);
-		deferred.s(deserialize$1(ctx, depth, node.a[1]));
-		return;
-	}
-	throw new SerovalMissingInstanceError("Promise");
-}
-function deserializePromiseReject(ctx, depth, node) {
-	const deferred = ctx.base.refs.get(node.i);
-	if (deferred) {
-		validateNodeType(ctx, node, node.i, 22);
-		deferred.f(deserialize$1(ctx, depth, node.a[1]));
+		const deserialized = deserialize$1(ctx, depth, node.a[1]);
+		if (isThennable(deserialized)) throw new SerovalMalformedNodeError(node.a[1]);
+		if (node.t === 23) deferred.s(deserialized);
+		else deferred.f(deserialized);
 		return;
 	}
 	throw new SerovalMissingInstanceError("Promise");
@@ -1522,8 +1523,8 @@ function deserialize$1(ctx, depth, node) {
 		case 21: return deserializeBoxed(ctx, depth, node);
 		case 25: return deserializePlugin(ctx, depth, node);
 		case 22: return deserializePromiseConstructor(ctx, node);
-		case 23: return deserializePromiseResolve(ctx, depth, node);
-		case 24: return deserializePromiseReject(ctx, depth, node);
+		case 23:
+		case 24: return deserializePromiseFulfill(ctx, depth, node);
 		case 28: return deserializeIteratorFactoryInstance(ctx, depth, node);
 		case 30: return deserializeAsyncIteratorFactoryInstance(ctx, depth, node);
 		case 31: return deserializeStreamConstructor(ctx, depth, node);
@@ -1916,9 +1917,10 @@ function serializeStringKeyAssignment(ctx, source, mainAssignments, key, value)
 	const serialized = serialize$1(ctx, value);
 	const check = Number(key);
 	const isIdentifier = check >= 0 && check.toString() === key || isValidIdentifier(key);
-	if (isIndexedValueInStack(base, value)) if (isIdentifier && check !== check) createObjectAssign(ctx, source.i, key, serialized);
-	else createArrayAssign(ctx, source.i, isIdentifier ? key : "\"" + key + "\"", serialized);
-	else {
+	if (isIndexedValueInStack(base, value)) {
+		if (isIdentifier && check !== check) createObjectAssign(ctx, source.i, key, serialized);
+		else createArrayAssign(ctx, source.i, isIdentifier ? key : "\"" + key + "\"", serialized);
+	} else {
 		const parentAssignment = base.assignments;
 		base.assignments = mainAssignments;
 		if (isIdentifier && check !== check) createObjectAssign(ctx, source.i, key, serialized);
@@ -2545,7 +2547,6 @@ function parseObjectPhase2(ctx, depth, id, current, currentClass) {
 		case DataView: return parseDataView(ctx, depth, id, current);
 		case Map: return parseMap(ctx, depth, id, current);
 		case Set: return parseSet(ctx, depth, id, current);
-		default: break;
 	}
 	if (currentClass === Promise || current instanceof Promise) return parsePromise(ctx, depth, id, current);
 	const currentFeatures = ctx.base.features;
@@ -2553,7 +2554,6 @@ function parseObjectPhase2(ctx, depth, id, current, currentClass) {
 	if (currentFeatures & 16) switch (currentClass) {
 		case BigInt64Array:
 		case BigUint64Array: return parseBigIntTypedArray(ctx, depth, id, current);
-		default: break;
 	}
 	if (currentFeatures & 1 && typeof AggregateError !== "undefined" && (currentClass === AggregateError || current instanceof AggregateError)) return parseAggregateError(ctx, depth, id, current);
 	if (currentFeatures & 64 && typeof Temporal !== "undefined") switch (currentClass) {
@@ -2565,7 +2565,6 @@ function parseObjectPhase2(ctx, depth, id, current, currentClass) {
 		case Temporal.PlainTime: return createTemporalNode(id, 5, current);
 		case Temporal.PlainYearMonth: return createTemporalNode(id, 6, current);
 		case Temporal.ZonedDateTime: return createTemporalNode(id, 7, current);
-		default: break;
 	}
 	if (current instanceof Error) return parseError(ctx, depth, id, current);
 	if (SYM_ITERATOR in current || SYM_ASYNC_ITERATOR in current) return parsePlainObject(ctx, depth, id, current, !!currentClass);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "seroval",
   "type": "module",
-  "version": "1.6.1",
+  "version": "1.6.3",
   "files": [
     "dist"
   ],
@@ -16,15 +16,15 @@
     "serialization"
   ],
   "devDependencies": {
-    "@types/node": "^24.10.0",
-    "@vitest/ui": "^4.0.6",
-    "esbuild": "^0.28.1",
-    "temporal-polyfill": "^0.3.2",
+    "@types/node": "^26.2.0",
+    "@vitest/ui": "^4.1.10",
+    "esbuild": "^0.28.2",
+    "temporal-polyfill": "^1.0.3",
     "ts-prune": "^0.10.3",
     "tsdown": "^0.22.14",
     "tslib": "^2.8.1",
     "typescript": "^7.0.2",
-    "vitest": "^4.0.6"
+    "vitest": "^4.1.10"
   },
   "private": false,
   "description": "Stringify JS values",