You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Serialize JavaScript to a superset of JSON that includes regular expressions, dates and functions.
Overview
The code in this package began its life as an internal module to express-state. To expand its usefulness, it now lives as serialize-javascript -- an independent package on npm.
You're probably wondering: What about JSON.stringify()!? We've found that sometimes we need to serialize JavaScript functions, regexps, dates, sets or maps. A great example is a web app that uses client-side URL routing where the route definitions are regexps that need to be shared from the server to the client.
The string returned from this package's single export function is literal JavaScript which can be saved to a .js file, or be embedded into an HTML document by making the content of a '
});">serialize({ haxorXSS: '' });
The above will produce the following string, HTML-escaped output which is safe to put into an HTML document as it will not cause the inline script element to terminate:
'{"haxorXSS":"\\u003C\\u002Fscript\\u003E"}'
You can pass an optional unsafe argument to serialize() for straight serialization.
Options
The serialize() function accepts an options object as its second argument. All options are being defaulted to undefined:
options.space
This option is the same as the space argument that can be passed to JSON.stringify. It can be used to add whitespace and indentation to the serialized output to make it more readable.
serialize(obj,{space: 2});
options.isJSON
This option is a signal to serialize() that the object being serialized does not contain any function or regexps values. This enables a hot-path that allows serialization to be over 3x faster. If you're serializing a lot of data, and know its pure JSON, then you can enable this option for a speed-up.
Note: That when using this option, the output will still be escaped to protect against XSS.
serialize(obj,{isJSON: true});
options.unsafe
This option is to signal serialize() that we want to do a straight conversion, without the XSS protection. This options needs to be explicitly set to true. HTML characters and JavaScript line terminators will not be escaped. You will have to roll your own.
serialize(obj,{unsafe: true});
options.ignoreFunction
This option is to signal serialize() that we do not want serialize JavaScript function.
Just treat function like JSON.stringify do, but other features will work as expected.
serialize(obj,{ignoreFunction: true});
Deserializing
For some use cases you might also need to deserialize the string. This is explicitly not part of this module. However, you can easily write it yourself:
