Serialize-javascript is a valuable npm package designed for developers who need to convert JavaScript objects into a string format that goes beyond standard JSON. It skillfully handles regular expressions and functions, elements JSON can't represent, making it ideal for scenarios like server-side rendering where you need to pass complex data from the server to the client. Comparing version 3.0.0 with the prior stable version 2.1.2, we see a few key differences. While both versions share the same core purpose, description, license (BSD-3-Clause), and author, there are subtle shifts in the development dependencies and package details. Version 3.0.0 has upgraded its testing dependencies, notably using Mocha version 7.0.0 and NYC version 15.0.0 for code coverage, whereas version 2.1.2 employed Mocha 6.2.0 and NYC 14.1.1. The dist metadata also reveals slight changes. Version 3.0.0 includes 5 files in its tarball and a slightly larger unpacked size of 15281 bytes compared to version 2.1.2's 4 files and 14831 bytes of unpacked size. Additionally, version 3.0.0 was released on February 16, 2020, while version 2.1.2 was released on December 9, 2019. These updates suggest improvements in testing, code coverage, and potentially minor bug fixes or enhancements within the serialization logic. For developers, this means a more robust and reliable option with potentially better test coverage and newer tooling, without fundamentally altering the core functionality of serializing JavaScript objects.
All the vulnerabilities related to the version 3.0.0 of the package
Insecure serialization leading to RCE in serialize-javascript
serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".
An object such as {"foo": /1"/, "bar": "a\"@__R-<UID>-0__@"} was serialized as {"foo": /1"/, "bar": "a\/1"/}, which allows an attacker to escape the bar key. This requires the attacker to control the values of both foo and bar and guess the value of <UID>. The UID has a keyspace of approximately 4 billion making it a realistic network attack.
