|
| 1 | +const suspectProtoRx |
| 2 | + = /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/ |
| 3 | +const suspectConstructorRx |
| 4 | + = /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/ |
| 5 | +// eslint-disable-next-line |
| 6 | +const JsonSigRx = /^\s*["[{]|^\s*-?\d{1,16}(\.\d{1,17})?(E[+-]?\d+)?\s*$/i |
| 7 | + |
| 8 | +function jsonParseTransform(key: string, value: any): any { |
| 9 | + if ( |
| 10 | + key === '__proto__' |
| 11 | + || (key === 'constructor' |
| 12 | + && value |
| 13 | + && typeof value === 'object' |
| 14 | + && 'prototype' in value) |
| 15 | + ) { |
| 16 | + warnKeyDropped(key) |
| 17 | + return |
| 18 | + } |
| 19 | + return value |
| 20 | +} |
| 21 | + |
| 22 | +function warnKeyDropped(key: string): void { |
| 23 | + console.warn(`[destr] Dropping "${key}" key to prevent prototype pollution.`) |
| 24 | +} |
| 25 | + |
| 26 | +export interface Options { |
| 27 | + strict?: boolean |
| 28 | + customVal?: any |
| 29 | +} |
| 30 | +/** |
| 31 | + * @description A faster, secure and convenient alternative for `JSON.parse` |
| 32 | + * @param value The value to be parsed |
| 33 | + * @param options The options |
| 34 | + * @returns parsed value |
| 35 | + * @category tools |
| 36 | + * @example |
| 37 | + * ``` |
| 38 | + * // Returns "[foo" |
| 39 | + * destr("[foo"); |
| 40 | + * // Return is not valid JSON |
| 41 | + * Json.parse("[foo") |
| 42 | + * ``` |
| 43 | + */ |
| 44 | +export function destr<T = unknown>(value: any, options: Options = {}): T { |
| 45 | + if (typeof value !== 'string') { |
| 46 | + return value |
| 47 | + } |
| 48 | + |
| 49 | + const _value = value.trim() |
| 50 | + if ( |
| 51 | + |
| 52 | + value[0] === '"' |
| 53 | + && value.endsWith('"') |
| 54 | + && !value.includes('\\') |
| 55 | + ) { |
| 56 | + return _value.slice(1, -1) as T |
| 57 | + } |
| 58 | + |
| 59 | + if (_value.length <= 9) { |
| 60 | + const _lval = _value.toLowerCase() |
| 61 | + if (_lval === 'true') { |
| 62 | + return true as T |
| 63 | + } |
| 64 | + if (_lval === 'false') { |
| 65 | + return false as T |
| 66 | + } |
| 67 | + if (_lval === 'undefined') { |
| 68 | + return undefined as T |
| 69 | + } |
| 70 | + if (_lval === 'null') { |
| 71 | + return null as T |
| 72 | + } |
| 73 | + if (_lval === 'nan') { |
| 74 | + return Number.NaN as T |
| 75 | + } |
| 76 | + if (_lval === 'infinity') { |
| 77 | + return Number.POSITIVE_INFINITY as T |
| 78 | + } |
| 79 | + if (_lval === '-infinity') { |
| 80 | + return Number.NEGATIVE_INFINITY as T |
| 81 | + } |
| 82 | + } |
| 83 | + |
| 84 | + if (!JsonSigRx.test(value)) { |
| 85 | + if (options.customVal !== undefined) { |
| 86 | + return options.customVal as T |
| 87 | + } |
| 88 | + if (options.strict) { |
| 89 | + throw new SyntaxError('[destr] Invalid JSON') |
| 90 | + } |
| 91 | + return value as T |
| 92 | + } |
| 93 | + |
| 94 | + try { |
| 95 | + if (suspectProtoRx.test(value) || suspectConstructorRx.test(value)) { |
| 96 | + if (options.customVal !== undefined) { |
| 97 | + return options.customVal as T |
| 98 | + } |
| 99 | + if (options.strict) { |
| 100 | + throw new Error('[destr] Possible prototype pollution') |
| 101 | + } |
| 102 | + return JSON.parse(value, jsonParseTransform) |
| 103 | + } |
| 104 | + return JSON.parse(value) |
| 105 | + } |
| 106 | + catch (error) { |
| 107 | + if (options.customVal !== undefined) { |
| 108 | + return options.customVal as T |
| 109 | + } |
| 110 | + if (options.strict) { |
| 111 | + throw error |
| 112 | + } |
| 113 | + return value as T |
| 114 | + } |
| 115 | +} |
| 116 | +/** |
| 117 | + * @description A faster, secure and convenient alternative for `JSON.parse` |
| 118 | + * @param value The value to be parsed |
| 119 | + * @param options The options |
| 120 | + * @returns parsed value |
| 121 | + * @category tools |
| 122 | + * @example |
| 123 | + * ``` |
| 124 | + * // Throws an error |
| 125 | + * safeDestr("[foo"); |
| 126 | + * // Return is not valid JSON |
| 127 | + * Json.parse("[foo") |
| 128 | + * ``` |
| 129 | + */ |
| 130 | +export function safeDestr<T = unknown>(value: any, options: Options = {}): T { |
| 131 | + return destr<T>(value, { ...options, strict: true }) |
| 132 | +} |
| 133 | + |
| 134 | +/** |
| 135 | + * @description A faster, secure and convenient alternative for `JSON.parse` |
| 136 | + * @param value The value to be parsed |
| 137 | + * @param options The options |
| 138 | + * @returns parsed value |
| 139 | + * @category tools |
| 140 | + * @example |
| 141 | + * ``` |
| 142 | + * // Returns "defaultVal" |
| 143 | + * customDestr<string>("[foo", { customVal: "defaultVal" }); |
| 144 | + * // Return is not valid JSON |
| 145 | + * Json.parse("[foo") |
| 146 | + * ``` |
| 147 | + */ |
| 148 | +export function customDestr<T = unknown>(value: any, options: Options = {}): T { |
| 149 | + if (options.customVal === undefined) |
| 150 | + return destr<T>(value, { ...options, customVal: null }) |
| 151 | + return destr<T>(value, { ...options }) |
| 152 | +} |
| 153 | + |
| 154 | +export default destr |
0 commit comments