yahoo / yahoo/serialize-javascript

feat: option to inject code verbatim

Open
#43 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
2.9k
Forks
215
Avg merge
1d 12h
Merged PRs (30d)
2

Description

It would be handy for a use case I have for this package to support a feature that could inject code verbatim if it appears in a JavaScript object.

To implement, we could use (A) a special object constructor, (B) a special property on a string, or (C) a tagged template literal returning some special value, which would allow us to detect such cases in the serialization code.

A:

const object = {
  customCode: serialize.verbatim('window.navigator.userAgent')
};

B:

const customCode = 'window.navigator.userAgent';
customCode.verbatim = true;
const object = {
  customCode
};

C:

const customCode = serialize.verbatim`window.navigator.userAgent`;
const object = {
  customCode
};

I tried a hack similar to https://github.com/yahoo/serialize-javascript/issues/32#issuecomment-350184098 using a function as a value and overriding its toString method, but it didn't work since I can't include ( in the code without it being rewritten as part of the function serialization.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the package's serialization code to understand how JavaScript object values are currently converted and where function strings are rewritten. Decide how the proposed verbatim value should be represented and detected, then verify that injected code remains unchanged while ordinary values retain existing serialization behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.