added version

.output/server/node_modules/devalue/src/uneval.js

@@ -6,7 +6,8 @@ import {
 	is_plain_object,
 	is_primitive,
 	stringify_key,
-	stringify_string
+	stringify_string,
+	valid_array_indices
 } from './utils.js';
 
 const chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_$';
@@ -131,7 +132,16 @@ export function uneval(value, replacer) {
 						);
 					}
 
-					for (const key in thing) {
+					for (const key of Object.keys(thing)) {
+						if (key === '__proto__') {
+							throw new DevalueError(
+								`Cannot stringify objects with __proto__ keys`,
+								keys,
+								thing,
+								value
+							);
+						}
+
 						keys.push(stringify_key(key));
 						walk(thing[key]);
 						keys.pop();
@@ -190,12 +200,85 @@ export function uneval(value, replacer) {
 			case 'URLSearchParams':
 				return `new URLSearchParams(${stringify_string(thing.toString())})`;
 
-			case 'Array':
-				const members = /** @type {any[]} */ (thing).map((v, i) =>
-					i in thing ? stringify(v) : ''
-				);
+			case 'Array': {
+				// For dense arrays (no holes), we iterate normally.
+				// When we encounter the first hole, we call Object.keys
+				// to determine the sparseness, then decide between:
+				//   - Array literal with holes: [,"a",,] (default)
+				//   - Object.assign: Object.assign(Array(n),{...}) (for very sparse arrays)
+				// Only the Object.assign path avoids iterating every slot, which
+				// is what protects against the DoS of e.g. `arr[1000000] = 1`.
+				let has_holes = false;
+
+				let result = '[';
+
+				for (let i = 0; i < thing.length; i += 1) {
+					if (i > 0) result += ',';
+
+					if (Object.hasOwn(thing, i)) {
+						result += stringify(thing[i]);
+					} else if (!has_holes) {
+						// Decide between array literal and Object.assign.
+						//
+						// Array literal: holes are consecutive commas.
+						// For example, [, "a", ,] is written as [,"a",,].
+						// Each hole costs 1 char (a comma).
+						//
+						// Object.assign: populated indices are listed explicitly.
+						// For example, [, "a", ,] would be written as
+						// Object.assign(Array(3),{1:"a"}). This avoids paying
+						// per-hole, but has a large fixed overhead for the
+						// "Object.assign(Array(n),{...})" wrapper, and each
+						// element costs extra chars for its index and colon.
+						//
+						// The serialized values are the same size either way, so
+						// the choice comes down to the structural overhead:
+						//
+						//   Array literal overhead:
+						//     1 char per element or hole (comma separators)
+						//     + 2 chars for "[" and "]"
+						//     = L + 2
+						//
+						//   Object.assign overhead:
+						//     "Object.assign(Array(" — 20 chars
+						//     + length              — d chars
+						//     + "),{"               — 3 chars
+						//     + for each populated element:
+						//       index + ":" + ","   — (d + 2) chars
+						//     + "})"                — 2 chars
+						//     = (25 + d) + P * (d + 2)
+						//
+						// where L is the array length, P is the number of
+						// populated elements, and d is the number of digits
+						// in L (an upper bound on the digits in any index).
+						//
+						// Object.assign is cheaper when:
+						//   (25 + d) + P * (d + 2) < L + 2
+						const populated_keys = valid_array_indices(/** @type {any[]} */ (thing));
+						const population = populated_keys.length;
+						const d = String(thing.length).length;
+
+						const hole_cost = thing.length + 2;
+						const sparse_cost = (25 + d) + population * (d + 2);
+
+						if (hole_cost > sparse_cost) {
+							const entries = populated_keys
+								.map((k) => `${k}:${stringify(thing[k])}`)
+								.join(',');
+							return `Object.assign(Array(${thing.length}),{${entries}})`;
+						}
+
+						// Re-process this index as a hole in the array literal
+						has_holes = true;
+						i -= 1;
+					}
+					// else: already decided on array literal, hole is just an empty slot
+					// (the comma separator is all we need — no content for this position)
+				}
+
 				const tail = thing.length === 0 || thing.length - 1 in thing ? '' : ',';
-				return `[${members.join(',')}${tail}]`;
+				return result + tail + ']';
+			}
 
 			case 'Set':
 			case 'Map':