joshnuss / svelte-persisted-store

A Svelte store that persists to localStorage
MIT License
997 stars 41 forks source link

Enhancement: Protect parsing from errors #193

Closed webJose closed 11 months ago

webJose commented 1 year ago

The call to serializer.parse() should be inside a try..catch. Users may directly tamper with stored values which might cause errors while parsing.

joshnuss commented 11 months ago

My preference is to only catch when there is something that can be done about it.

For situations where errors are expected and custom serializer can be passed.

webJose commented 11 months ago

Things can be done. The ideal scenario would be to run an onError handler and let the consumer of the store to determine what to do.

onError, (just as validate in my other issue) would be passed as options.

This way the consumer of the value will be assured that any malformations will be notified through this mechanism.

Why leaving it as-is is bad

Because your application may have 1000 entry points that could trigger reading the malformed value. Are we going to write try..catch everywhere? No. We would most likely have to introduce a proxy of some kind.

joshnuss commented 11 months ago

I understand, but I want to be careful about how many options this repo provides. The more that is added, the more docs are needed and it brings more complexity for an super edge case.

Feel free to fork and add any edge cases you need.