Code:

const lib = require('serialize-to-js');

const testData = {
  mtd(arg) { return arg },
};

const serializedData = lib.serialize(testData);
const deserializeData = lib.deserialize(serializedData, true);

console.log(testData);
console.log(deserializeData);

We want to migrate from serialize-javascript (https://github.com/yahoo/serialize-javascript) in webpack to your library. Two blokers:

• This issue
• #7

Hi,

There's no third-party types available for this package, so I had to add my own:

declare module "serialize-to-js" {
  export = serialize;

  function serialize(source: any, options?: { ignoreCircular?: boolean, reference?: boolean, unsafe?: boolean }): string;
}

I'm honestly not an expert in this area, but putting this in a serialize-to-js.d.ts file in the root of my project worked - you could probably just dump this as index.d.ts in the root folder and the package would have type-checking in TS and auto-completions in VS Code and other editors.

Cheers 🙂

Since updating to v1.1.0 I'm getting this issue whilst building.

ERROR in ./~/serialize-to-js/lib/deserialize.js
Module not found: Error: Can't resolve 'safer-eval' in '~/Code/thingy/node_modules/serialize-to-js/lib'
 @ ./~/serialize-to-js/lib/deserialize.js 9:16-37
 @ ./~/serialize-to-js/lib/index.js
 @ ./app/views/PrintView.js
 @ ./app/routes.js
 @ ./app/app.js
 @ ./app/index.js
 @ multi webpack-hot-middleware/client?reload=true ./app

Resolved it for now by downgrading to v1.0.0

Using Node v6.9.1 with NPM v3.10.8 on macOS 10.12.3

var payload = "{e: (function(){ eval('console.log(`exploited`)') })() }"
var serialize = require('serialize-to-js');
serialize.deserialize(payload);

I don't know if this is a functionality as you are using new Function() internally, but the module should not execute code on deserialization.

Why:

• reduce package size
• no need beautify by default, main purpose is serialization, not pretty printing
• there a lot of other buitifiers (example i like prettier)

Hi, just wanted to let you know, that of today NPM released an advisory that serialize-to-js is vulnerable to Denial of Service attacks with a high severity.

https://npmjs.com/advisories/790

Would be great if you could look into it and hopefully resolve the vulnerability soon :)

Are functions supported at all? What happens when a property value is a function?

Hi! This seems like a really promising library for debugging complex JS applications :) Or serialising complex JS objects.

In our code, we often use Map, but references in there get copied by value. Is there a way to generate JS code that will construct the full JS object?

var serialize = require('serialize-to-js')

var fooBar = {foo:"bar"}

let m = new Map()
m.set('key1', fooBar)
m.set('key2', fooBar)

var obj = {
  ref1: fooBar,
  ref2: fooBar,
  ref3: fooBar,
  m: m,
}

var opts = { reference: true }
var withoutRefs = serialize(obj, opts)
console.log(opts.references)

var refsCode = "var tmp = " + withoutRefs + ";\n"
for(var i = 0; i < opts.references.length; i+= 1){
    var entry = opts.references[i];
    refsCode += "tmp" + entry[0] + " = tmp" + entry[1] + ";\n"
}
console.log(refsCode)
// var tmp = {ref1: {foo: "bar"}}
// tmp.ref2 = tmp.ref1;
// tmp.ref3 = tmp.ref1;
// The refs in the map are missing :(

serialize an object {backSlash: "\\"} would result in {backSlash: "\"} which would cause error when deserialize later on. The serialize should produce {backSlash: "\\"} as in JSON.stringify.