fix(evaluate): make sure to try/catch toJSON access (#27238)

This commit is contained in:
Dmitry Gozman 2023-09-21 13:31:28 -07:00 committed by GitHub
parent 14a3659071
commit 1857a3fb56
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 26 additions and 3 deletions

View file

@ -208,9 +208,15 @@ export function source() {
o.push({ k: name, v: serialize(item, handleSerializer, visitorInfo) });
}
// If Object.keys().length === 0 we fall back to toJSON if it exists
if (o.length === 0 && value.toJSON && typeof value.toJSON === 'function')
return innerSerialize(value.toJSON(), handleSerializer, visitorInfo);
let jsonWrapper;
try {
// If Object.keys().length === 0 we fall back to toJSON if it exists
if (o.length === 0 && value.toJSON && typeof value.toJSON === 'function')
jsonWrapper = { value: value.toJSON() };
} catch (e) {
}
if (jsonWrapper)
return innerSerialize(jsonWrapper.value, handleSerializer, visitorInfo);
return { o, id };
}

View file

@ -654,6 +654,23 @@ it('should not use toJSON in jsonValue', async ({ page }) => {
expect(await resultHandle.jsonValue()).toEqual({ data: 'data', toJSON: {} });
});
it('should ignore buggy toJSON', async ({ page }) => {
const result = await page.evaluate(() => {
class Foo {
toJSON() {
throw new Error('Bad');
}
}
class Bar {
get toJSON() {
throw new Error('Also bad');
}
}
return { foo: new Foo(), bar: new Bar() };
});
expect(result).toEqual({ foo: {}, bar: {} });
});
it('should not expose the injected script export', async ({ page }) => {
expect(await page.evaluate('typeof pwExport === "undefined"')).toBe(true);
});