Skip to content

fix: escape caught error messages in safe mode - #81

Open
RealBhupesh wants to merge 3 commits into
BridgeAR:mainfrom
RealBhupesh:fix-safe-error-escaping
Open

RealBhupesh wants to merge 3 commits into
BridgeAR:mainfrom
RealBhupesh:fix-safe-error-escaping

Conversation

@RealBhupesh

Copy link
Copy Markdown

With safe: true, an error thrown by a getter is converted to a string result. makeSafe currently adds quote characters around that result without escaping the message, so quotes, newlines or control characters can produce invalid JSON.

const { configure } = require('safe-stable-stringify')
const stringify = configure({ safe: true })
const input = { get token () { throw new Error('Missing "token"') } }
JSON.parse(stringify(input)) // SyntaxError before this change

This uses the existing strEscape helper for the caught-error result. The change preserves the current root error-string behavior; it does not switch to per-property recovery or change unsafe mode.

Added 35 regression assertions for quotes, newlines, backslashes, NUL and a lone surrogate. They cover compact output, indentation and an array replacer, with a function-replacer control. Running the new test on the original source fails at the first malformed quoted message, including a JSON.parse error.

Validation on current main bdd585f plus this patch:

  • npm test: 84,326 passed, 1 skipped, including Standard lint.
  • npm run tsc: passed.

No dependency, option or API changes. AI assistance is recorded in the commit trailers.

Use the existing JSON string escaping helper for caught errors.

Assisted-by: LLM
Remove editor auto-indentation from the final brace.

Assisted-by: LLM
Cover quotes, newlines, backslashes, NUL and lone surrogates across compact, indented and replacer modes.

Assisted-by: LLM
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant