update
This commit is contained in:
+1
-1
@@ -1,6 +1,6 @@
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2019 - Pooya Parsa <pyapar@gmail.com>
|
||||
Copyright (c) UnJS
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
|
||||
+3
-3
@@ -38,7 +38,7 @@ console.log(destr('{ "deno": "yay" }'))
|
||||
|
||||
## Why?
|
||||
|
||||
Please note that `destr` is little bit slower when parsing a standard JSON string mainly because of transform to avoid [prototype pollution](https://hueniverse.com/a-tale-of-prototype-poisoning-2610fa170061) which can lead to serious security issues if not being sanetized. In the other words, `destr` is better when input is not always a json string or from untrsuted source like request body.
|
||||
Please note that `destr` is little bit slower when parsing a standard JSON string mainly because of transform to avoid [prototype pollution](https://hueniverse.com/a-tale-of-prototype-poisoning-2610fa170061) which can lead to serious security issues if not being sanitized. In the other words, `destr` is better when input is not always a json string or from untrusted source like request body.
|
||||
|
||||
**Fast fallback to input if is not string:**
|
||||
|
||||
@@ -110,8 +110,8 @@ MIT. Made with 💖
|
||||
[npm-d-src]: https://img.shields.io/npm/dm/destr?style=flat-square
|
||||
[npm-d-href]: https://npmjs.com/package/destr
|
||||
|
||||
[github-actions-src]: https://img.shields.io/github/workflow/status/nuxt-contrib/destr/ci/master?style=flat-square
|
||||
[github-actions-href]: https://github.com/nuxt-contrib/destr/actions?query=workflow%3Aci
|
||||
[github-actions-src]: https://img.shields.io/github/workflow/status/unjs/destr/ci/master?style=flat-square
|
||||
[github-actions-href]: https://github.com/unjs/destr/actions?query=workflow%3Aci
|
||||
|
||||
[bundlephobia-src]: https://img.shields.io/bundlephobia/min/destr?style=flat-square
|
||||
[bundlephobia-href]: https://bundlephobia.com/result?p=destr
|
||||
|
||||
+48
@@ -0,0 +1,48 @@
|
||||
'use strict';
|
||||
|
||||
const suspectProtoRx = /"(?:_|\\u005[Ff])(?:_|\\u005[Ff])(?:p|\\u0070)(?:r|\\u0072)(?:o|\\u006[Ff])(?:t|\\u0074)(?:o|\\u006[Ff])(?:_|\\u005[Ff])(?:_|\\u005[Ff])"\s*:/;
|
||||
const suspectConstructorRx = /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/;
|
||||
const JsonSigRx = /^["{[]|^-?[0-9][0-9.]{0,14}$/;
|
||||
function jsonParseTransform(key, value) {
|
||||
if (key === "__proto__" || key === "constructor") {
|
||||
return;
|
||||
}
|
||||
return value;
|
||||
}
|
||||
function destr(val) {
|
||||
if (typeof val !== "string") {
|
||||
return val;
|
||||
}
|
||||
const _lval = val.toLowerCase();
|
||||
if (_lval === "true") {
|
||||
return true;
|
||||
}
|
||||
if (_lval === "false") {
|
||||
return false;
|
||||
}
|
||||
if (_lval === "null") {
|
||||
return null;
|
||||
}
|
||||
if (_lval === "nan") {
|
||||
return NaN;
|
||||
}
|
||||
if (_lval === "infinity") {
|
||||
return Infinity;
|
||||
}
|
||||
if (_lval === "undefined") {
|
||||
return void 0;
|
||||
}
|
||||
if (!JsonSigRx.test(val)) {
|
||||
return val;
|
||||
}
|
||||
try {
|
||||
if (suspectProtoRx.test(val) || suspectConstructorRx.test(val)) {
|
||||
return JSON.parse(val, jsonParseTransform);
|
||||
}
|
||||
return JSON.parse(val);
|
||||
} catch (_e) {
|
||||
return val;
|
||||
}
|
||||
}
|
||||
|
||||
module.exports = destr;
|
||||
+3
-1
@@ -1 +1,3 @@
|
||||
export default function destr(val: any): any;
|
||||
declare function destr(val: any): any;
|
||||
|
||||
export { destr as default };
|
||||
|
||||
+46
@@ -0,0 +1,46 @@
|
||||
const suspectProtoRx = /"(?:_|\\u005[Ff])(?:_|\\u005[Ff])(?:p|\\u0070)(?:r|\\u0072)(?:o|\\u006[Ff])(?:t|\\u0074)(?:o|\\u006[Ff])(?:_|\\u005[Ff])(?:_|\\u005[Ff])"\s*:/;
|
||||
const suspectConstructorRx = /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/;
|
||||
const JsonSigRx = /^["{[]|^-?[0-9][0-9.]{0,14}$/;
|
||||
function jsonParseTransform(key, value) {
|
||||
if (key === "__proto__" || key === "constructor") {
|
||||
return;
|
||||
}
|
||||
return value;
|
||||
}
|
||||
function destr(val) {
|
||||
if (typeof val !== "string") {
|
||||
return val;
|
||||
}
|
||||
const _lval = val.toLowerCase();
|
||||
if (_lval === "true") {
|
||||
return true;
|
||||
}
|
||||
if (_lval === "false") {
|
||||
return false;
|
||||
}
|
||||
if (_lval === "null") {
|
||||
return null;
|
||||
}
|
||||
if (_lval === "nan") {
|
||||
return NaN;
|
||||
}
|
||||
if (_lval === "infinity") {
|
||||
return Infinity;
|
||||
}
|
||||
if (_lval === "undefined") {
|
||||
return void 0;
|
||||
}
|
||||
if (!JsonSigRx.test(val)) {
|
||||
return val;
|
||||
}
|
||||
try {
|
||||
if (suspectProtoRx.test(val) || suspectConstructorRx.test(val)) {
|
||||
return JSON.parse(val, jsonParseTransform);
|
||||
}
|
||||
return JSON.parse(val);
|
||||
} catch (_e) {
|
||||
return val;
|
||||
}
|
||||
}
|
||||
|
||||
export { destr as default };
|
||||
+34
-24
@@ -1,67 +1,77 @@
|
||||
{
|
||||
"_args": [
|
||||
[
|
||||
"destr@1.0.0",
|
||||
"/mnt/Foxconn/Digitalent/Deverloper/liff-push_2series"
|
||||
"destr@1.1.1",
|
||||
"/home/node/nuxt"
|
||||
]
|
||||
],
|
||||
"_from": "destr@1.0.0",
|
||||
"_id": "destr@1.0.0",
|
||||
"_from": "destr@1.1.1",
|
||||
"_id": "destr@1.1.1",
|
||||
"_inBundle": false,
|
||||
"_integrity": "sha512-uw0zD4688l00hDftUP76EWyweDtOB/0mVd/8GvmwecYD+Akw5Z4v43pw4onVsz4rC/BsfnZnDMG2rdTGhVIODA==",
|
||||
"_integrity": "sha512-QqkneF8LrYmwATMdnuD2MLI3GHQIcBnG6qFC2q9bSH430VTCDAVjcspPmUaKhPGtAtPAftIUFqY1obQYQuwmbg==",
|
||||
"_location": "/destr",
|
||||
"_phantomChildren": {},
|
||||
"_requested": {
|
||||
"type": "version",
|
||||
"registry": true,
|
||||
"raw": "destr@1.0.0",
|
||||
"raw": "destr@1.1.1",
|
||||
"name": "destr",
|
||||
"escapedName": "destr",
|
||||
"rawSpec": "1.0.0",
|
||||
"rawSpec": "1.1.1",
|
||||
"saveSpec": null,
|
||||
"fetchSpec": "1.0.0"
|
||||
"fetchSpec": "1.1.1"
|
||||
},
|
||||
"_requiredBy": [
|
||||
"/@nuxt/cli",
|
||||
"/@nuxt/config",
|
||||
"/@nuxt/telemetry",
|
||||
"/rc9"
|
||||
],
|
||||
"_resolved": "https://registry.npmjs.org/destr/-/destr-1.0.0.tgz",
|
||||
"_spec": "1.0.0",
|
||||
"_where": "/mnt/Foxconn/Digitalent/Deverloper/liff-push_2series",
|
||||
"_resolved": "https://registry.npmjs.org/destr/-/destr-1.1.1.tgz",
|
||||
"_spec": "1.1.1",
|
||||
"_where": "/home/node/nuxt",
|
||||
"bugs": {
|
||||
"url": "https://github.com/nuxt-contrib/destr/issues"
|
||||
"url": "https://github.com/unjs/destr/issues"
|
||||
},
|
||||
"description": "A faster, secure and convenient alternative for JSON.parse",
|
||||
"devDependencies": {
|
||||
"@hapi/bourne": "^2.0.0",
|
||||
"@hapi/bourne": "latest",
|
||||
"@nuxtjs/eslint-config-typescript": "latest",
|
||||
"benchmark": "latest",
|
||||
"bili": "latest",
|
||||
"eslint": "latest",
|
||||
"rollup-plugin-typescript2": "latest",
|
||||
"secure-json-parse": "^2.1.0",
|
||||
"secure-json-parse": "latest",
|
||||
"standard-version": "latest",
|
||||
"typescript": "latest"
|
||||
"typescript": "latest",
|
||||
"unbuild": "latest"
|
||||
},
|
||||
"exports": {
|
||||
".": {
|
||||
"import": "./dist/index.mjs",
|
||||
"require": "./dist/index.cjs"
|
||||
}
|
||||
},
|
||||
"files": [
|
||||
"dist"
|
||||
],
|
||||
"homepage": "https://github.com/nuxt-contrib/destr#readme",
|
||||
"homepage": "https://github.com/unjs/destr#readme",
|
||||
"license": "MIT",
|
||||
"main": "dist/index.js",
|
||||
"main": "./dist/index.cjs",
|
||||
"module": "./dist/index.mjs",
|
||||
"name": "destr",
|
||||
"packageManager": "pnpm@6.32.3",
|
||||
"repository": {
|
||||
"type": "git",
|
||||
"url": "git+https://github.com/nuxt-contrib/destr.git"
|
||||
"url": "git+https://github.com/unjs/destr.git"
|
||||
},
|
||||
"scripts": {
|
||||
"bench": "yarn build && node ./bench.js",
|
||||
"build": "bili src/index.ts",
|
||||
"bench": "pnpm build && node ./bench.cjs",
|
||||
"build": "unbuild",
|
||||
"lint": "eslint --ext .ts .",
|
||||
"release": "yarn test && yarn build && standard-version && git push --follow-tags && npm publish",
|
||||
"test": "yarn lint"
|
||||
"release": "pnpm test && pnpm build && standard-version && git push --follow-tags && pnpm publish",
|
||||
"test": "pnpm lint"
|
||||
},
|
||||
"type": "module",
|
||||
"types": "dist/index.d.ts",
|
||||
"version": "1.0.0"
|
||||
"version": "1.1.1"
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user