flightcontrolhq / superjson

Safely serialize JavaScript expressions to a superset of JSON, which includes Dates, BigInts, and more.
https://www.flightcontrol.dev?ref=superjson
MIT License
4.01k stars 87 forks source link

fix: only throw error on field with annotation #274

Closed Skn0tt closed 1 month ago

Skn0tt commented 10 months ago

This comes out of the discussion in https://github.com/blitz-js/superjson/pull/267. We can narrow down the cases where an error is thrown. It's only necessary if the polluting key results in an annotation, in all other cases there's no risk for prototype pollution.