{"_id":"@nuxtjs/devalue","_rev":"1515334","name":"@nuxtjs/devalue","description":"Gets the job done when JSON.stringify can't","dist-tags":{"latest":"1.2.3"},"maintainers":[{"name":"aldarund","email":"aldarund@gmail.com"},{"name":"atinux","email":"atinux@gmail.com"},{"name":"clarkdo","email":"clark.duxin@gmail.com"},{"name":"pi0","email":"pooya@pi0.ir"}],"time":{"modified":"2021-11-10T06:20:37.000Z","created":"2018-10-04T12:48:40.677Z","1.2.3":"2019-04-14T20:45:17.925Z","1.2.0":"2018-12-20T10:48:01.809Z","1.1.0":"2018-11-02T23:56:00.505Z","1.0.1":"2018-10-15T19:08:42.640Z","1.0.0":"2018-10-04T12:48:40.677Z"},"users":{},"repository":{"type":"git","url":"git+https://github.com/nuxt-community/devalue.git"},"versions":{"1.2.3":{"name":"@nuxtjs/devalue","description":"Gets the job done when JSON.stringify can't","version":"1.2.3","repository":{"type":"git","url":"git+https://github.com/nuxt-community/devalue.git"},"main":"dist/devalue.cjs.js","module":"dist/devalue.esm.js","browser":"dist/devalue.js","types":"types/index.d.ts","dependencies":{"consola":"^2.5.6"},"devDependencies":{"@types/mocha":"^5.2.6","@types/node":"^11.9.5","glob":"^7.1.3","mocha":"^6.0.2","rollup":"^1.3.2","rollup-plugin-typescript":"^1.0.0","rollup-plugin-virtual":"^1.0.1","sander":"^0.6.0","ts-node":"^8.0.2","tslib":"^1.9.3","typescript":"^3.3.3333"},"scripts":{"build-declarations":"tsc -d && node scripts/move-type-declarations.js","build":"npm run build-declarations && rollup -c","test":"mocha --opts mocha.opts","prepublishOnly":"npm run build && npm test"},"license":"LIL","gitHead":"6b06aaf0184ff35bf45f87e6de9900563f4f8133","bugs":{"url":"https://github.com/nuxt-community/devalue/issues"},"homepage":"https://github.com/nuxt-community/devalue#readme","_id":"@nuxtjs/devalue@1.2.3","_nodeVersion":"11.13.0","_npmVersion":"6.9.0","dist":{"shasum":"99916fecf893c71efe88593c3aa3518e551e5723","size":7081,"noattachment":false,"key":"/@nuxtjs/devalue/-/@nuxtjs/devalue-1.2.3.tgz","tarball":"http://registry.cnpm.dingdandao.com/@nuxtjs/devalue/download/@nuxtjs/devalue-1.2.3.tgz"},"maintainers":[{"name":"aldarund","email":"aldarund@gmail.com"},{"name":"atinux","email":"atinux@gmail.com"},{"name":"clarkdo","email":"clark.duxin@gmail.com"},{"name":"pi0","email":"pooya@pi0.ir"}],"_npmUser":{"name":"pi0","email":"pyapar@gmail.com"},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/devalue_1.2.3_1555274717794_0.5401496293960102"},"_hasShrinkwrap":false,"publish_time":1555274717925,"_cnpm_publish_time":1555274717925},"1.2.0":{"name":"@nuxtjs/devalue","description":"Gets the job done when JSON.stringify can't","version":"1.2.0","repository":{"type":"git","url":"git+https://github.com/nuxt-community/devalue.git"},"main":"dist/devalue.cjs.js","module":"dist/devalue.esm.js","browser":"dist/devalue.js","types":"types/index.d.ts","dependencies":{"consola":"^2.3.0"},"devDependencies":{"@types/mocha":"^5.2.5","@types/node":"^10.12.15","glob":"^7.1.3","mocha":"^5.2.0","rollup":"^0.68.0","rollup-plugin-typescript":"^1.0.0","rollup-plugin-virtual":"^1.0.1","sander":"^0.6.0","ts-node":"^7.0.1","tslib":"^1.9.3","typescript":"^3.2.2"},"scripts":{"build-declarations":"tsc -d && node scripts/move-type-declarations.js","build":"npm run build-declarations && rollup -c","test":"mocha --opts mocha.opts","prepublishOnly":"npm run build && npm test"},"license":"LIL","gitHead":"919f83a51a6f06f43a0a94d87f4c5f3ee76c0eb5","bugs":{"url":"https://github.com/nuxt-community/devalue/issues"},"homepage":"https://github.com/nuxt-community/devalue#readme","_id":"@nuxtjs/devalue@1.2.0","_npmVersion":"6.4.1","_nodeVersion":"11.4.0","_npmUser":{"name":"pi0","email":"pyapar@gmail.com"},"dist":{"shasum":"f3f40c4678916a7159b9e43e9cef57db0390538f","size":6703,"noattachment":false,"key":"/@nuxtjs/devalue/-/@nuxtjs/devalue-1.2.0.tgz","tarball":"http://registry.cnpm.dingdandao.com/@nuxtjs/devalue/download/@nuxtjs/devalue-1.2.0.tgz"},"maintainers":[{"name":"aldarund","email":"aldarund@gmail.com"},{"name":"atinux","email":"atinux@gmail.com"},{"name":"clarkdo","email":"clark.duxin@gmail.com"},{"name":"pi0","email":"pooya@pi0.ir"}],"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/devalue_1.2.0_1545302881715_0.5522128479170951"},"_hasShrinkwrap":false,"publish_time":1545302881809,"_cnpm_publish_time":1545302881809},"1.1.0":{"name":"@nuxtjs/devalue","description":"Gets the job done when JSON.stringify can't","version":"1.1.0","repository":{"type":"git","url":"git+https://github.com/nuxt-community/devalue.git"},"main":"dist/devalue.umd.js","module":"dist/devalue.esm.js","types":"types/index.d.ts","dependencies":{"consola":"^2.0.7"},"devDependencies":{"@types/mocha":"^5.2.5","@types/node":"^10.11.7","glob":"^7.1.3","mocha":"^5.2.0","rollup":"^0.66.6","rollup-plugin-typescript":"^1.0.0","rollup-plugin-virtual":"^1.0.1","sander":"^0.6.0","ts-node":"^7.0.1","tslib":"^1.9.3","typescript":"^3.1.3"},"scripts":{"build-declarations":"tsc -d && node scripts/move-type-declarations.js","build":"npm run build-declarations && rollup -c","test":"mocha --opts mocha.opts","prepublishOnly":"npm run build && npm test"},"license":"LIL","gitHead":"fcc458584f2e9539c043125215c98b7ed94d466e","bugs":{"url":"https://github.com/nuxt-community/devalue/issues"},"homepage":"https://github.com/nuxt-community/devalue#readme","_id":"@nuxtjs/devalue@1.1.0","_npmVersion":"6.4.1","_nodeVersion":"8.11.3","_npmUser":{"name":"pi0","email":"pyapar@gmail.com"},"dist":{"shasum":"4dcdf33d914f6ea71b09da365452dd1016390d64","size":5947,"noattachment":false,"key":"/@nuxtjs/devalue/-/@nuxtjs/devalue-1.1.0.tgz","tarball":"http://registry.cnpm.dingdandao.com/@nuxtjs/devalue/download/@nuxtjs/devalue-1.1.0.tgz"},"maintainers":[{"name":"aldarund","email":"aldarund@gmail.com"},{"name":"atinux","email":"atinux@gmail.com"},{"name":"clarkdo","email":"clark.duxin@gmail.com"},{"name":"pi0","email":"pooya@pi0.ir"}],"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/devalue_1.1.0_1541202960284_0.8609857532150373"},"_hasShrinkwrap":false,"publish_time":1541202960505,"_cnpm_publish_time":1541202960505},"1.0.1":{"name":"@nuxtjs/devalue","description":"Gets the job done when JSON.stringify can't","version":"1.0.1","repository":{"type":"git","url":"git+https://github.com/nuxt-community/devalue.git"},"main":"dist/devalue.umd.js","module":"dist/devalue.esm.js","types":"types/index.d.ts","dependencies":{"consola":"^1.4.3"},"devDependencies":{"@types/mocha":"^5.2.5","@types/node":"^10.11.7","glob":"^7.1.3","mocha":"^5.2.0","rollup":"^0.66.6","rollup-plugin-typescript":"^1.0.0","rollup-plugin-virtual":"^1.0.1","sander":"^0.6.0","ts-node":"^7.0.1","tslib":"^1.9.3","typescript":"^3.1.3"},"scripts":{"build-declarations":"tsc -d && node scripts/move-type-declarations.js","build":"npm run build-declarations && rollup -c","test":"mocha --opts mocha.opts","prepublishOnly":"npm run build && npm test"},"license":"LIL","gitHead":"bfb9d9a112bc20af51568a44ca0e3c632ce17e1c","bugs":{"url":"https://github.com/nuxt-community/devalue/issues"},"homepage":"https://github.com/nuxt-community/devalue#readme","_id":"@nuxtjs/devalue@1.0.1","_npmVersion":"6.4.1","_nodeVersion":"10.11.0","_npmUser":{"name":"aldarund","email":"aldarund@gmail.com"},"dist":{"shasum":"661f16ed4c5d4bf64ab8b6e66fa1aa16bc57d504","size":5966,"noattachment":false,"key":"/@nuxtjs/devalue/-/@nuxtjs/devalue-1.0.1.tgz","tarball":"http://registry.cnpm.dingdandao.com/@nuxtjs/devalue/download/@nuxtjs/devalue-1.0.1.tgz"},"maintainers":[{"name":"aldarund","email":"aldarund@gmail.com"},{"name":"atinux","email":"atinux@gmail.com"},{"name":"clarkdo","email":"clark.duxin@gmail.com"},{"name":"pi0","email":"pooya@pi0.ir"}],"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/devalue_1.0.1_1539630522544_0.1974297217097929"},"_hasShrinkwrap":false,"publish_time":1539630522640,"_cnpm_publish_time":1539630522640},"1.0.0":{"name":"@nuxtjs/devalue","description":"Gets the job done when JSON.stringify can't","version":"1.0.0","repository":{"type":"git","url":"git+https://github.com/nuxt-community/devalue.git"},"main":"dist/devalue.umd.js","module":"dist/devalue.esm.js","types":"types/index.d.ts","dependencies":{"consola":"^1.4.3"},"devDependencies":{"@types/mocha":"^2.2.44","@types/node":"^8.0.53","glob":"^7.1.2","mocha":"^4.0.1","rollup":"^0.52.0","rollup-plugin-typescript":"^0.8.1","rollup-plugin-virtual":"^1.0.1","sander":"^0.6.0","ts-node":"^3.3.0","typescript":"^2.6.2"},"scripts":{"build-declarations":"tsc -d && node scripts/move-type-declarations.js","build":"npm run build-declarations && rollup -c","test":"mocha --opts mocha.opts","prepublishOnly":"npm run build && npm test"},"license":"LIL","gitHead":"c3943a4ff2847b677eeae1655d3cafe1111e701a","bugs":{"url":"https://github.com/nuxt-community/devalue/issues"},"homepage":"https://github.com/nuxt-community/devalue#readme","_id":"@nuxtjs/devalue@1.0.0","_npmVersion":"6.4.1","_nodeVersion":"10.11.0","_npmUser":{"name":"aldarund","email":"aldarund@gmail.com"},"dist":{"shasum":"97c5cfbac0cd3eb7a7894a4e1bfe5c22eeee3ab3","size":5083,"noattachment":false,"key":"/@nuxtjs/devalue/-/@nuxtjs/devalue-1.0.0.tgz","tarball":"http://registry.cnpm.dingdandao.com/@nuxtjs/devalue/download/@nuxtjs/devalue-1.0.0.tgz"},"maintainers":[{"name":"aldarund","email":"aldarund@gmail.com"},{"name":"atinux","email":"atinux@gmail.com"},{"name":"clarkdo","email":"clark.duxin@gmail.com"},{"name":"pi0","email":"pooya@pi0.ir"}],"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/devalue_1.0.0_1538657320493_0.0880281166029262"},"_hasShrinkwrap":false,"publish_time":1538657320677,"_cnpm_publish_time":1538657320677}},"readme":"# @nuxt/devalue\n\n[![npm version][npm-version-src]][npm-version-href]\n[![npm downloads][npm-downloads-src]][npm-downloads-href]\n[![Circle CI][circleci-src]][circleci-href]\n[![package phobia][package-phobia-src]][package-phobia-href]\n[![bundle phobia][bundle-phobia-src]][bundle-phobia-href]\n\n> Forked from [devalue](https://github.com/Rich-Harris/devalue) to log errors on non-serializable properties rather than throwing `Error`.\n\nLike `JSON.stringify`, but handles\n\n* cyclical references (`obj.self = obj`)\n* repeated references (`[value, value]`)\n* `undefined`, `Infinity`, `NaN`, `-0`\n* regular expressions\n* dates\n* `Map` and `Set`\n* `.toJSON()` method for non-POJOs\n\nTry it out on [runkit.com](https://npm.runkit.com/@nuxt/devalue).\n\n## Goals:\n\n* Performance\n* Security (see [XSS mitigation](#xss-mitigation))\n* Compact output\n\n\n## Non-goals:\n\n* Human-readable output\n* Stringifying functions or arbritary non-POJOs\n\n\n## Usage\n\n```js\nimport devalue from '@nuxt/devalue';\n\nlet obj = { a: 1, b: 2 };\nobj.c = 3;\n\ndevalue(obj); // '{a:1,b:2,c:3}'\n\nobj.self = obj;\ndevalue(obj); // '(function(a){a.a=1;a.b=2;a.c=3;a.self=a;return a}({}))'\n```\n\nIf `devalue` encounters a function or a non-POJO, it will throw an error.\n\n\n## XSS mitigation\n\nSay you're server-rendering a page and want to serialize some state, which could include user input. `JSON.stringify` doesn't protect against XSS attacks:\n\n```js\nconst state = {\n  userinput: `</script><script src='https://evil.com/mwahaha.js'>`\n};\n\nconst template = `\n<script>\n  // NEVER DO THIS\n  var preloaded = ${JSON.stringify(state)};\n</script>`;\n```\n\nWhich would result in this:\n\n```html\n<script>\n  // NEVER DO THIS\n  var preloaded = {\"userinput\":\"</script><script src='https://evil.com/mwahaha.js'>\"};\n</script>\n```\n\nUsing `devalue`, we're protected against that attack:\n\n```js\nconst template = `\n<script>\n  var preloaded = ${devalue(state)};\n</script>`;\n```\n\n```html\n<script>\n  var preloaded = {userinput:\"\\\\u003C\\\\u002Fscript\\\\u003E\\\\u003Cscript src=\\'https:\\\\u002F\\\\u002Fevil.com\\\\u002Fmwahaha.js\\'\\\\u003E\"};\n</script>\n```\n\nThis, along with the fact that `devalue` bails on functions and non-POJOs, stops attackers from executing arbitrary code. Strings generated by `devalue` can be safely deserialized with `eval` or `new Function`:\n\n```js\nconst value = (0,eval)('(' + str + ')');\n```\n\n\n## Other security considerations\n\nWhile `devalue` prevents the XSS vulnerability shown above, meaning you can use it to send data from server to client, **you should not send user data from client to server** using the same method. Since it has to be evaluated, an attacker that successfully submitted data that bypassed `devalue` would have access to your system.\n\nWhen using `eval`, ensure that you call it *indirectly* so that the evaluated code doesn't have access to the surrounding scope:\n\n```js\n{\n  const sensitiveData = 'Setec Astronomy';\n  eval('sendToEvilServer(sensitiveData)'); // pwned :(\n  (0,eval)('sendToEvilServer(sensitiveData)'); // nice try, evildoer!\n}\n```\n\nUsing `new Function(code)` is akin to using indirect eval.\n\n\n## See also\n\n* [lave](https://github.com/jed/lave) by Jed Schmidt\n* [arson](https://github.com/benjamn/arson) by Ben Newman\n* [tosource](https://github.com/marcello3d/node-tosource) by Marcello Bastéa-Forte\n* [serialize-javascript](https://github.com/yahoo/serialize-javascript) by Eric Ferraiuolo\n\n\n## License\n\n[LIL](LICENSE)\n\n<!-- Refs -->\n[npm-version-src]: https://flat.badgen.net/npm/v/@nuxt/devalue/latest\n[npm-version-href]: https://www.npmjs.com/package/@nuxt/devalue\n\n[npm-downloads-src]: https://flat.badgen.net/npm/dm/@nuxt/devalue\n[npm-downloads-href]: https://www.npmjs.com/package/@nuxt/devalue\n\n[circleci-src]: https://flat.badgen.net/circleci/github/nuxt/devalue\n[circleci-href]: https://circleci.com/gh/nuxt/devalue\n\n[package-phobia-src]: https://flat.badgen.net/packagephobia/install/@nuxt/devalue\n[package-phobia-href]: https://packagephobia.now.sh/result?p=@nuxt/devalue\n\n[bundle-phobia-src]: https://flat.badgen.net/bundlephobia/minzip/@nuxt/devalue\n[bundle-phobia-href]: https://bundlephobia.com/result?p=@nuxt/devalue\n","_attachments":{},"homepage":"https://github.com/nuxt-community/devalue#readme","bugs":{"url":"https://github.com/nuxt-community/devalue/issues"},"license":"LIL"}