added version

.output/server/node_modules/devalue/src/stringify.js

@@ -5,7 +5,8 @@ import {
 	is_plain_object,
 	is_primitive,
 	stringify_key,
-	stringify_string
+	stringify_string,
+	valid_array_indices
 } from './utils.js';
 import {
 	HOLE,
@@ -13,6 +14,7 @@ import {
 	NEGATIVE_INFINITY,
 	NEGATIVE_ZERO,
 	POSITIVE_INFINITY,
+	SPARSE,
 	UNDEFINED
 } from './constants.js';
 import { encode64 } from './base64.js';
@@ -105,24 +107,89 @@ export function stringify(value, reducers) {
 						: `["RegExp",${stringify_string(source)}]`;
 					break;
 
-				case 'Array':
+				case 'Array': {
+					// For dense arrays (no holes), we iterate normally.
+					// When we encounter the first hole, we call Object.keys
+					// to determine the sparseness, then decide between:
+					//   - HOLE encoding: [-2, val, -2, ...] (default)
+					//   - Sparse encoding: [-7, length, idx, val, ...] (for very sparse arrays)
+					// Only the sparse path avoids iterating every slot, which
+					// is what protects against the DoS of e.g. `arr[1000000] = 1`.
+					let mostly_dense = false;
+
 					str = '[';
 
 					for (let i = 0; i < thing.length; i += 1) {
 						if (i > 0) str += ',';
 
-						if (i in thing) {
+						if (Object.hasOwn(thing, i)) {
 							keys.push(`[${i}]`);
 							str += flatten(thing[i]);
 							keys.pop();
-						} else {
+						} else if (mostly_dense) {
+							// Use dense encoding. The heuristic guarantees the
+							// array is only mildly sparse, so iterating over every
+							// slot is fine.
 							str += HOLE;
+						} else {
+							// Decide between HOLE encoding and sparse encoding.
+							//
+							// HOLE encoding: each hole is serialized as the HOLE
+							// sentinel (-2). For example, [, "a", ,] becomes
+							// [-2, 0, -2]. Each hole costs 3 chars ("-2" + comma).
+							//
+							// Sparse encoding: lists only populated indices.
+							// For example, [, "a", ,] becomes [-7, 3, 1, 0] — the
+							// -7 sentinel, the array length (3), then index-value
+							// pairs. This avoids paying per-hole, but each element
+							// costs extra chars to write its index.
+							//
+							// The values are the same size either way, so the
+							// choice comes down to structural overhead:
+							//
+							//   HOLE overhead:
+							//     3 chars per hole ("-2" + comma)
+							//     = (L - P) * 3
+							//
+							//   Sparse overhead:
+							//     "-7,"          — 3 chars (sparse sentinel + comma)
+							//     + length + "," — (d + 1) chars (array length + comma)
+							//     + per element: index + "," — (d + 1) chars
+							//     = (4 + d) + P * (d + 1)
+							//
+							// where L is the array length, P is the number of
+							// populated elements, and d is the number of digits
+							// in L (an upper bound on the digits in any index).
+							//
+							// Sparse encoding is cheaper when:
+							//   (4 + d) + P * (d + 1) < (L - P) * 3
+							const populated_keys = valid_array_indices(/** @type {any[]} */ (thing));
+							const population = populated_keys.length;
+							const d = String(thing.length).length;
+
+							const hole_cost = (thing.length - population) * 3;
+							const sparse_cost = 4 + d + population * (d + 1);
+
+							if (hole_cost > sparse_cost) {
+								str = '[' + SPARSE + ',' + thing.length;
+								for (let j = 0; j < populated_keys.length; j++) {
+									const key = populated_keys[j];
+									keys.push(`[${key}]`);
+									str += ',' + key + ',' + flatten(thing[key]);
+									keys.pop();
+								}
+								break;
+							} else {
+								mostly_dense = true;
+								str += HOLE;
+							}
 						}
 					}
 
 					str += ']';
 
 					break;
+				}
 
 				case 'Set':
 					str = '["Set"';
@@ -217,7 +284,16 @@ export function stringify(value, reducers) {
 
 					if (Object.getPrototypeOf(thing) === null) {
 						str = '["null"';
-						for (const key in thing) {
+						for (const key of Object.keys(thing)) {
+							if (key === '__proto__') {
+								throw new DevalueError(
+									`Cannot stringify objects with __proto__ keys`,
+									keys,
+									thing,
+									value
+								);
+							}
+
 							keys.push(stringify_key(key));
 							str += `,${stringify_string(key)},${flatten(thing[key])}`;
 							keys.pop();
@@ -226,7 +302,16 @@ export function stringify(value, reducers) {
 					} else {
 						str = '{';
 						let started = false;
-						for (const key in thing) {
+						for (const key of Object.keys(thing)) {
+							if (key === '__proto__') {
+								throw new DevalueError(
+									`Cannot stringify objects with __proto__ keys`,
+									keys,
+									thing,
+									value
+								);
+							}
+
 							if (started) str += ',';
 							started = true;
 							keys.push(stringify_key(key));