flightcontrolhq / superjson

Safely serialize JavaScript expressions to a superset of JSON, which includes Dates, BigInts, and more.
https://www.flightcontrol.dev?ref=superjson
MIT License
4.17k stars 90 forks source link

fix: only throw error on field with annotation #274

Closed Skn0tt closed 3 months ago

Skn0tt commented 1 year ago

This comes out of the discussion in https://github.com/blitz-js/superjson/pull/267. We can narrow down the cases where an error is thrown. It's only necessary if the polluting key results in an annotation, in all other cases there's no risk for prototype pollution.