npm package discovery and stats viewer.

Discover Tips

  • General search

    [free text search, go nuts!]

  • Package details

    pkg:[package-name]

  • User packages

    @[username]

Sponsor

Optimize Toolset

I’ve always been into building performant and accessible sites, but lately I’ve been taking it extremely seriously. So much so that I’ve been building a tool to help me optimize and monitor the sites that I build to make sure that I’m making an attempt to offer the best experience to those who visit them. If you’re into performant, accessible and SEO friendly sites, you might like it too! You can check it out at Optimize Toolset.

About

Hi, 👋, I’m Ryan Hefner  and I built this site for me, and you! The goal of this site was to provide an easy way for me to check the stats on my npm packages, both for prioritizing issues and updates, and to give me a little kick in the pants to keep up on stuff.

As I was building it, I realized that I was actually using the tool to build the tool, and figured I might as well put this out there and hopefully others will find it to be a fast and useful way to search and browse npm packages as I have.

If you’re interested in other things I’m working on, follow me on Twitter or check out the open source projects I’ve been publishing on GitHub.

I am also working on a Twitter bot for this site to tweet the most popular, newest, random packages from npm. Please follow that account now and it will start sending out packages soon–ish.

Open Software & Tools

This site wouldn’t be possible without the immense generosity and tireless efforts from the people who make contributions to the world and share their work via open source initiatives. Thank you 🙏

© 2024 – Pkg Stats / Ryan Hefner

@namecheap/serialize-javascript

v6.4.1

Published

Serialize JavaScript to a superset of JSON that includes regular expressions and functions.

Downloads

55

Readme

Serialize JavaScript

Serialize JavaScript to a superset of JSON that includes regular expressions, dates, and functions.

This library is a fork of the [serialize-javascript] library that addresses browser compatibility by using the native crypto module. In the original library, generating a randomUID depends on the randombytes library, which in turn depends on the safe-buffer library that requires the buffer package to be present. However, since Webpack 5 stopped polyfilling Node.js built-in modules, this package now needs to be installed manually.

This results in a 57 KB increase in bundle size, which seems excessive compared to the built-in crypto implementation widely available in modern browsers and the Node.js runtime. This motivated an update to the implementation to use the built-in crypto module.

Overview

You're probably wondering: What about JSON.stringify()!? We've found that sometimes we need to serialize JavaScript functions, regexps, dates, sets or maps. A great example is a web app that uses client-side URL routing where the route definitions are regexps that need to be shared from the server to the client. But this module is also great for communicating between node processes.

The string returned from this package's single export function is literal JavaScript which can be saved to a .js file, or be embedded into an HTML document by making the content of a <script> element.

HTML characters and JavaScript line terminators are escaped automatically.

Please note that serialization for ES6 Sets & Maps requires support for Array.from (not available in IE or Node < 0.12), or an Array.from polyfill.

Installation

Install using npm:

$ npm install serialize-javascript

Usage

var serialize = require('serialize-javascript');

serialize({
    str  : 'string',
    num  : 0,
    obj  : {foo: 'foo'},
    arr  : [1, 2, 3],
    bool : true,
    nil  : null,
    undef: undefined,
    inf  : Infinity,
    date : new Date("Thu, 28 Apr 2016 22:02:17 GMT"),
    map  : new Map([['hello', 'world']]),
    set  : new Set([123, 456]),
    fn   : function echo(arg) { return arg; },
    re   : /([^\s]+)/g,
    big  : BigInt(10),
    url  : new URL('https://example.com/'),
});

The above will produce the following string output:

'{"str":"string","num":0,"obj":{"foo":"foo"},"arr":[1,2,3],"bool":true,"nil":null,"undef":undefined,"inf":Infinity,"date":new Date("2016-04-28T22:02:17.000Z"),"map":new Map([["hello","world"]]),"set":new Set([123,456]),"fn":function echo(arg) { return arg; },"re":new RegExp("([^\\\\s]+)", "g"),"big":BigInt("10"),"url":new URL("https://example.com/")}'

Note: to produce a beautified string, you can pass an optional second argument to serialize() to define the number of spaces to be used for the indentation.

Automatic Escaping of HTML Characters

A primary feature of this package is to serialize code to a string of literal JavaScript which can be embedded in an HTML document by adding it as the contents of the <script> element. In order to make this safe, HTML characters and JavaScript line terminators are escaped automatically.

serialize({
    haxorXSS: '</script>'
});

The above will produce the following string, HTML-escaped output which is safe to put into an HTML document as it will not cause the inline script element to terminate:

'{"haxorXSS":"\\u003C\\u002Fscript\\u003E"}'

You can pass an optional unsafe argument to serialize() for straight serialization.

Options

The serialize() function accepts an options object as its second argument. All options are being defaulted to undefined:

options.space

This option is the same as the space argument that can be passed to JSON.stringify. It can be used to add whitespace and indentation to the serialized output to make it more readable.

serialize(obj, {space: 2});

options.isJSON

This option is a signal to serialize() that the object being serialized does not contain any function or regexps values. This enables a hot-path that allows serialization to be over 3x faster. If you're serializing a lot of data, and know its pure JSON, then you can enable this option for a speed-up.

Note: That when using this option, the output will still be escaped to protect against XSS.

serialize(obj, {isJSON: true});

options.unsafe

This option is to signal serialize() that we want to do a straight conversion, without the XSS protection. This options needs to be explicitly set to true. HTML characters and JavaScript line terminators will not be escaped. You will have to roll your own.

serialize(obj, {unsafe: true});

options.ignoreFunction

This option is to signal serialize() that we do not want serialize JavaScript function. Just treat function like JSON.stringify do, but other features will work as expected.

serialize(obj, {ignoreFunction: true});

Deserializing

For some use cases you might also need to deserialize the string. This is explicitly not part of this module. However, you can easily write it yourself:

function deserialize(serializedJavascript){
  return eval('(' + serializedJavascript + ')');
}

Note: Don't forget the parentheses around the serialized javascript, as the opening bracket { will be considered to be the start of a body.

License

This software is free to use under the Yahoo! Inc. BSD license. See the LICENSE file for license text and copyright information.