Copying objects in JavaScript

Re:Copying objects in JavaScript by Null-Set on Tuesday November 13, 2018 @01:09PM (#18443183)

As of version 8.0.0 node has exposed a serialization api which is compatible with structured clone. https://nodejs.org/api/v8.html#v8_serialization_api

    const v8 = require('v8');
    const buf = v8.serialize({a: 'foo', b: new Date()});
    const cloned = v8.deserialize(buf);
    cloned.b.getMonth();

[ Parent | on HN ]

Re:Copying objects in JavaScript by devoply on Tuesday November 13, 2018 @09:44PM (#18447018)

Have we learned nothing from Java's serialization fiasco?

[ Parent | on HN ]

Re:Copying objects in JavaScript by foota on Wednesday November 14, 2018 @06:39AM (#18449135)

I don't know how the JavaScript proposal does it, but you can certainly create generic clone structures that are safe for untrusted input.

[ Parent | on HN ]

Re:Copying objects in JavaScript by nur0n on Tuesday November 13, 2018 @10:34PM (#18447256)

I want to learn, can you elaborate?

[ Parent | on HN ]

Re:Copying objects in JavaScript by fulafel on Thursday November 15, 2018 @12:11AM (#18457011)

Java's deserialization will instantiate any classes that the data tells it to, which in practice leads to myriad vulnerabilities as many classes have constructors that can be used to write files, execute shell commands, etc. Many programmers didn't realize this, and bad things happened.

This is a classic example: https://www.cvedetails.com/cve/CVE-2015-7501/

(Many more can be found under the CWE-502 "Deserialization of Untrusted Data" category)

[ Parent | on HN ]

Re:Copying objects in JavaScript by devoply on Tuesday November 13, 2018 @10:43PM (#18447294)

https://dzone.com/articles/jdk-11-beginning-of-the-end-for-j...

[ Parent | on HN ]

Re:Copying objects in JavaScript by wheresvic1 on Wednesday November 14, 2018 @12:09PM (#18451472)

That's awesome, I'll update the article to reflect this!

[ Parent | on HN ]