fix(serialize): read the constructor from the prototype - #207

Problem

serializeObject reads the object's class with object.constructor, which resolves an own constructor key before the prototype one. Such a key is easy to produce — JSON.parse output, a parsed query object, any user supplied record — and it currently breaks serialization three different ways:

import { serialize, hash } from "ohash";

serialize({ constructor: null });
// TypeError: Cannot read properties of null (reading 'name')

serialize({ constructor: 1 });
// "undefined{constructor:1}"   <- stray `undefined` prefix

serialize({ constructor: Date });
// Date(...) handler is selected for a plain object

The first case is the worst one: hash(JSON.parse(userJson)) throws instead of returning a hash, so a cache key or an ETag computed from untrusted JSON can take down the request. The third is subtler — globalThis[objName] === constructor passes because the own value is the global, so a plain object is routed through $Date / $Map / ... and either throws or hashes as something it is not.

Fix

Read the constructor from the prototype instead of from the object:

const constructor = Object.getPrototypeOf(object)?.constructor;

Class detection is unchanged for real instances (new Test() still has Test on its prototype), and an own constructor key is now treated as ordinary data:

serialize({ constructor: null }); // "{constructor:null}"
serialize({ constructor: 1 });    // "{constructor:1}"

?. covers Object.create(null), which previously landed on the constructor === undefined branch and still resolves to "".

Bundle size

The hash gzip budget needed +10 bytes (1548 → 1559) for the Object.getPrototypeOf call, so the assertion moves from 1550 to 1560. The serialize and diff budgets are unchanged. Happy to drop the budget change and shrink this differently if you would rather hold the line at 1.55 kB.

Tests

New own \constructor` keycase intest/serialize.test.tscovering the throw, theundefinedprefix,JSON.parseinput, the global-collision path, and that distinct values still hash distinctly. Full suite green: 91 passed, pluslintandtest:types`.

Summary by CodeRabbit

• Bug Fixes
  • Fixed serialization for objects with their own constructor property, including data parsed from JSON.
  • Such properties are now preserved as regular data instead of causing errors, incorrect type handling, or misleading class-based output.
  • Serialization now consistently distinguishes objects with different constructor values.