blitz-js / superjson

Safely serialize JavaScript expressions to a superset of JSON, which includes Dates, BigInts, and more.
MIT License
3.88k stars 83 forks source link

fix: only throw error on field with annotation #274

Open Skn0tt opened 8 months ago

Skn0tt commented 8 months ago

This comes out of the discussion in https://github.com/blitz-js/superjson/pull/267. We can narrow down the cases where an error is thrown. It's only necessary if the polluting key results in an annotation, in all other cases there's no risk for prototype pollution.