devalue - npm Package Compare versions

Comparing version 5.6.3 to 5.6.4

package.json

 {
   "name": "devalue",
   "description": "Gets the job done when JSON.stringify can't",
-  "version": "5.6.3",
+  "version": "5.6.4",
   "repository": "sveltejs/devalue",
@@ -6,0 +6,0 @@ "sideEffects": false,

src/parse.js

@@ -121,3 +121,9 @@ import { decode64 } from './base64.js';
 					case 'Object':
-						hydrated[index] = Object(value[1]);
+						const object = Object(value[1]);
+
+						if (Object.hasOwn(object, '__proto__')) {
+							throw new Error('Cannot parse an object with a `__proto__` property');
+						}
+
+						hydrated[index] = object;
 						break;
@@ -133,2 +139,6 @@
 						for (let i = 1; i < value.length; i += 2) {
+							if (value[i] === '__proto__') {
+								throw new Error('Cannot parse an object with a `__proto__` property');
+							}
+
 							obj[value[i]] = hydrate(value[i + 1]);
@@ -211,2 +221,6 @@ }
 
+				if (!Number.isInteger(len) || len < 0) {
+					throw new Error('Invalid input');
+				}
+
 				const array = new Array(len);
@@ -217,2 +231,7 @@ hydrated[index] = array;
 					const idx = value[i];
+
+					if (!Number.isInteger(idx) || idx < 0 || idx >= len) {
+						throw new Error('Invalid input');
+					}
+
 					array[idx] = hydrate(value[i + 1]);
@@ -219,0 +238,0 @@ }

No alert changes

Improved metrics

Total package byte prevSize

46394

1.07%

Lines of code

1262

1.04%

No dependency changes