serialize-javascript - npm Package Compare versions

Comparing version 7.0.2 to 7.0.3

index.js

@@ -251,7 +251,14 @@ /*
         if (type === 'D') {
-            return "new Date(\"" + dates[valueIndex].toISOString() + "\")";
+            // Validate ISO string format to prevent code injection via spoofed toISOString()
+            var isoStr = String(dates[valueIndex].toISOString());
+            if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{3})?Z$/.test(isoStr)) {
+                throw new TypeError('Invalid Date ISO string');
+            }
+            return "new Date(\"" + isoStr + "\")";
         }
 
         if (type === 'R') {
-            return "new RegExp(" + serialize(regexps[valueIndex].source) + ", \"" + regexps[valueIndex].flags + "\")";
+            // Sanitize flags to prevent code injection (only allow valid RegExp flag characters)
+            var flags = String(regexps[valueIndex].flags).replace(/[^gimsuydv]/g, '');
+            return "new RegExp(" + serialize(regexps[valueIndex].source) + ", \"" + flags + "\")";
         }
@@ -258,0 +265,0 @@

package.json

 {
   "name": "serialize-javascript",
-  "version": "7.0.2",
+  "version": "7.0.3",
   "description": "Serialize JavaScript to a superset of JSON that includes regular expressions and functions.",
@@ -5,0 +5,0 @@ "main": "index.js",

No alert changes

Improved metrics

Total package byte prevSize

19195

2.47%

Lines of code

244

2.95%

No dependency changes