Skip to content

Commit

Permalink
Use prototype toString to prevent bad serialization (vuejs#569)
Browse files Browse the repository at this point in the history
* Edge case of incorrectly serialized function 

Should fix vuejs#568

* Function.toString hijacking example

* Use prototype toString
  • Loading branch information
simplesmiler authored and Guillaume Chau committed Jan 26, 2018
1 parent d5b8a75 commit 6bb181d
Show file tree
Hide file tree
Showing 2 changed files with 17 additions and 3 deletions.
12 changes: 12 additions & 0 deletions shells/dev/target/NativeTypes.vue
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,17 @@
import { mapState, mapGetters, mapMutations } from 'vuex'
import CompDef from './Other.vue'
function setToString (func, string) {
return Object.defineProperty(func, 'toString', {
configurable: true,
enumerable: false,
value: () => string,
writable: true
})
}
const aWeirdFunction = setToString(function weird (a, b, c) {}, 'foo')
export default {
components: {
TestComponent: {
Expand All @@ -53,6 +64,7 @@ export default {
hello: function foo (a, b, c) {},
hey: function empty () {},
anon: function (foo, bar) {},
aWeirdFunction,
arrow: (a, b) => {},
def: CompDef,
def2: {
Expand Down
8 changes: 5 additions & 3 deletions src/util.js
Original file line number Diff line number Diff line change
Expand Up @@ -117,9 +117,9 @@ function replacer (key) {
return encodeCache.cache(val, () => getCustomSetDetails(val))
} else if (val instanceof RegExp) {
// special handling of native type
return `[native RegExp ${val.toString()}]`
return `[native RegExp ${RegExp.prototype.toString.call(val)}]`
} else if (val instanceof Date) {
return `[native Date ${val.toString()}]`
return `[native Date ${Date.prototype.toString.call(val)}]`
} else if (val.state && val._vm) {
return encodeCache.cache(val, () => getCustomStoreDetails(val))
} else if (val.constructor && val.constructor.name === 'VueRouter') {
Expand Down Expand Up @@ -230,7 +230,9 @@ export function getCustomComponentDefinitionDetails (def) {
}

export function getCustomFunctionDetails (func) {
const args = func.toString().match(/\(.*\)/)[0]
const string = Function.prototype.toString.call(func) || ''
const matches = string.match(/\(.*\)/)
const args = matches ? matches[0] : '(?)'
return {
_custom: {
type: 'function',
Expand Down

0 comments on commit 6bb181d

Please sign in to comment.