Merge commit from fork

* fix: prevent script close tag from being swallowed by a single match

`SCRIPT_CLOSE_REGEXP` matched `<\/script[^>]*>`, whose wildcard could run
from one `</script` to the next `>` anywhere in the function source. When a
second, complete `</script>` fell inside that span, the whole thing collapsed
into one match, and since the plain-code branch neutralizes only the leading
`<`, the swallowed tag was re-emitted verbatim.

A function body reaches that shape whenever `</script` appears in code
position -- `x</script=+/` parses as `x < /script=+/`, a comparison against a
regex literal -- followed by a `</script>` in a later string. The serialized
output then carries a live `</script>`, which terminates the script element
when embedded the way the README documents, so the rest of the payload is
parsed as HTML. Confirmed in headless Chromium: the injected `onerror` runs.

This regressed in v7.1.0. v7.0.7 used the same wildcard but escaped the
entire match, so nothing survived.

Excluding `<` from the character class fixes it: a match can no longer reach
past a second `<`, so every `</script` in the source either starts its own
match or is followed by a non-delimiter -- and the HTML tokenizer only ends
the tag name on TAB, LF, FF, CR, SPACE, `/` or `>`, emitting anything else as
text.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: reject spoofed function toString() and make native-code check stateless

Two defects in `serializeFunc`, found while investigating the script close
tag escaping.

`fn.toString()` was trusted to return a string. It is attacker-controlled in
the same way `URL.prototype.toString` and `RegExp.prototype.source` were
before they were hardened. Returning an object with its own `replace()` is
enough to defeat the escaping outright, because `escapeFunctionBody()` is
built entirely from `str.replace(...)` calls -- the object's `replace` simply
returns itself, and the payload reaches the output untouched:

    var f = function () {};
    f.toString = () => ({
        replace: function () { return this; },
        toString: () => 'function(){}</script><img src=x onerror=alert(1)>'
    });
    serialize({ f: f });
    // {"f":function(){}</script><img src=x onerror=alert(1)>}

A primitive string from a spoofed `toString()` was already safe; only the
non-string case bypasses escaping. Rejecting it matches how the URL and
RegExp spoofing cases are already handled.

Separately, `IS_NATIVE_CODE_REGEXP` carried a `/g` flag. `.test()` on a
global regexp advances `lastIndex`, so after one rejection the next call
began its scan past the `[native code]` match and returned false, letting
every other native function through:

    try { serialize(Math.max); } catch (e) {}  // correctly throws
    serialize(Math.min);                       // 'function min() { [native code] }'

That output is a syntax error rather than an injection, so the impact is
limited to an unreliable guard, but the flag serves no purpose here.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: redonkulus

index.js

@@ -11,20 +11,34 @@ var UID_LENGTH          = 16;
 var UID                 = generateUID();
 var PLACE_HOLDER_REGEXP = new RegExp('(\\\\)?"@__(F|R|D|M|S|A|U|I|B|L)-' + UID + '-(\\d+)__@"', 'g');
 
-var IS_NATIVE_CODE_REGEXP = /\{\s*\[native code\]\s*\}/g;
+// Not global: `.test()` on a `/g` regexp advances `lastIndex`, so a second
+// call could start past a `[native code]` match and wrongly report a native
+// function as safe to serialize.
+var IS_NATIVE_CODE_REGEXP = /\{\s*\[native code\]\s*\}/;
 var IS_PURE_FUNCTION = /function.*?\(/;
 var IS_ARROW_FUNCTION = /.*?=>.*?/;
 var UNSAFE_CHARS_REGEXP   = /[<>\/\u2028\u2029]/g;
 // Matches a script end tag (case-insensitive) for XSS protection: either a
-// full `</script...>` tag, or a bare `</script` followed by one of the
-// characters (TAB, LF, FF, CR, SPACE, `/`, `>`) that the HTML tokenizer
-// treats as ending the tag name (see the WHATWG "script data end tag name
-// state"). The bare-prefix form matters because the matching `>` could be
-// supplied by a different serialized value later in the output, so escaping
-// stops there without waiting for a closing `>`. A trailing backslash is not
-// a delimiter here (that's a JS-level concern, not an HTML one), so this
-// doesn't affect tagged template literals like `String.raw`.
-var SCRIPT_CLOSE_REGEXP = /<\/script[^>]*>|<\/script(?=[\t\n\f\r \/>])/gi;
+// literal `</script>`, or a bare `</script` followed by one of the other
+// characters (TAB, LF, FF, CR, SPACE, `/`) that the HTML tokenizer treats as
+// ending the tag name (see the WHATWG "script data end tag name state"). Any
+// other following character means the tokenizer emits `</script` as text and
+// stays in script data, so only these need neutralizing. The bare-prefix form
+// matters because the matching `>` could be supplied by a different
+// serialized value later in the output, so escaping stops there without
+// waiting for a closing `>`. A trailing backslash is not a delimiter here
+// (that's a JS-level concern, not an HTML one), so this doesn't affect tagged
+// template literals like `String.raw`.
+//
+// The `[^<>]*` in the first alternative excludes `<`, which is load-bearing:
+// it was previously `[^>]*`, letting a single match run from one `</script`
+// to the next `>` anywhere in the source and swallow a complete `</script>`
+// in between. Only one replacement is emitted per match, so the swallowed tag
+// survived verbatim in the output (PSECBUGS-117112). Because a match can no
+// longer contain a second `<`, every `</script` in the source is either the
+// start of its own match or is followed by a non-delimiter — and the latter
+// the tokenizer never treats as an end tag.
+var SCRIPT_CLOSE_REGEXP = /<\/script[^<>]*>|<\/script(?=[\t\n\f\r \/>])/gi;
 
 var RESERVED_SYMBOLS = ['*', 'async'];
 
@@ -206,6 +220,14 @@ module.exports = function serialize(obj, options) {
 
     function serializeFunc(fn, options) {
       var serializedFn = fn.toString();
+
+      // A spoofed `toString()` can return a non-string whose `replace()` is
+      // attacker-controlled, which would let it pass through
+      // `escapeFunctionBody()` unescaped and inject markup into the output.
+      if (typeof serializedFn !== 'string') {
+          throw new TypeError('Function.toString() must return a string');
+      }
+
       if (IS_NATIVE_CODE_REGEXP.test(serializedFn)) {
           throw new TypeError('Serializing native function: ' + fn.name);
       }

test/unit/serialize.js

@@ -121,6 +121,45 @@ describe('serialize( obj )', function () {
             strictEqual(err instanceof TypeError, true);
         });
 
+        it('should keep rejecting native built-ins after an earlier rejection', function () {
+            // The native-code check must not carry `lastIndex` state between
+            // calls, or every other native function would slip through.
+            throws(function () { serialize(Math.max); }, TypeError);
+            throws(function () { serialize(Math.min); }, TypeError);
+            throws(function () { serialize(Math.max); }, TypeError);
+        });
+
+        it('should throw when serializing a function with a spoofed non-string toString()', function () {
+            var fn = function () {};
+            fn.toString = function () {
+                return {
+                    toString: function () { return 'function(){}'; }
+                };
+            };
+            throws(function () { serialize({ fn: fn }); }, TypeError);
+        });
+
+        it('should throw when a spoofed toString() returns an object with its own replace()', function () {
+            // Without a type check, `escapeFunctionBody()` would call this
+            // object's `replace()`, which returns the payload unescaped.
+            var fn = function () {};
+            fn.toString = function () {
+                return {
+                    replace: function () { return this; },
+                    toString: function () {
+                        return 'function(){}</script><img src=x onerror=alert(1)>';
+                    }
+                };
+            };
+            throws(function () { serialize({ fn: fn }); }, TypeError);
+        });
+
+        it('should escape script close tags from a spoofed string toString()', function () {
+            var fn = function () {};
+            fn.toString = function () { return 'function(){}</script>'; };
+            strictEqual(serialize({ fn: fn }).indexOf('</script>'), -1);
+        });
+
         it('should serialize enhanced literal objects', function () {
             var obj = {
                 foo() { return true; },
@@ -604,6 +643,50 @@ describe('serialize( obj )', function () {
             strictEqual(deserialized(), '</script>');
         });
 
+        // A `</script` only ends the script element when the next character
+        // is one the HTML tokenizer accepts as ending the tag name. Followed
+        // by anything else it is emitted as text, so that is what must be
+        // absent from the output -- not every literal `</script` substring.
+        var CLOSES_SCRIPT = /<\/script[\t\n\f\r \/>]/i;
+
+        it('should not leak a second script close tag swallowed by the first match (PSECBUGS-117112)', function () {
+            // `x</script=+/` parses as `x < /script=+/` (a comparison against
+            // a regex literal), so `</script` appears in plain-code position
+            // with no `>` after it until the one inside the later string. The
+            // first regex alternative used to match across that whole span in
+            // one go, emitting the inner `</script>` raw.
+            var src = "function f(x){ return x</script=+/ + '</script><img src=x onerror=alert(1)>' }";
+            var fn = new Function('return ' + src)();
+            var serialized = serialize({ h: fn });
+
+            strictEqual(CLOSES_SCRIPT.test(serialized), false);
+            // The inner tag is inside a string literal, so it unicode-escapes.
+            strictEqual(serialized.includes('\\u003C\\u002Fscript\\u003E'), true);
+        });
+
+        it('should escape every script close tag when several appear in one function', function () {
+            var src = "function f(x){ return x</script=+/ + '</script>' + '</script>' + '</script >' }";
+            var fn = new Function('return ' + src)();
+            var serialized = serialize({ h: fn });
+
+            strictEqual(CLOSES_SCRIPT.test(serialized), false);
+        });
+
+        it('should not let a script close tag straddle plain code and a string', function () {
+            // The `</script` in code position and the one in the string must
+            // be classified separately, since only the latter can safely be
+            // rewritten as unicode escapes.
+            var src = "function f(x){ return x</script/ + '</script>' }";
+            var fn = new Function('return ' + src)();
+            var serialized = serialize({ h: fn });
+
+            strictEqual(CLOSES_SCRIPT.test(serialized), false);
+            // Code position: neutralized with a space, which parses the same.
+            strictEqual(serialized.includes('< /script/'), true);
+            // String position: unicode-escaped, preserving the runtime value.
+            strictEqual(serialized.includes('\\u003C\\u002Fscript\\u003E'), true);
+        });
+
         it('should encode unsafe HTML chars in arrow function bodies', function () {
             var fn = () => { return '</script>'; };
             var serialized = serialize(fn);