Function sanitizeJsonParse

packages/rest/src/parse-json.ts:24–52

(
  reviver?: (key: any, value: any) => any,
  prohibitedKeys?: string[],
)

 * @param prohibitedKeys - An array of keys to be rejected
 */
export function sanitizeJsonParse(
  reviver?: (key: any, value: any) => any,
  prohibitedKeys?: string[],
) {
  return (key: string, value: any) => {
    if (key === '__proto__') {
      // Reject `__proto__`
      throw new Error(`JSON string cannot contain "${key}" key.`);
    }
    if (
      key === 'constructor' &&
      value != null &&
      Object.keys(value).some(k => isMatched(k, 'prototype'))
    ) {
      // Reject `constructor/prototype.*`
      throw new Error(
        `JSON string cannot contain "constructor.prototype" key.`,
      );
    }
    if (prohibitedKeys?.some(pattern => isMatched(key, pattern))) {
      throw new Error(`JSON string cannot contain "${key}" key.`);
    }
    if (reviver) {
      return reviver(key, value);
    } else {
      return value;
    }
  };
}

/**
 * Parse a json string that rejects prohibited keys