fix: make sure depthLimit is passed down from config

Author: atilafassina

packages/seroval/src/core/cross/index.ts

@@ -161,6 +161,7 @@ export function toCrossJSONStream<T>(
     plugins,
     refs: options.refs,
     disabledFeatures: options.disabledFeatures,
+    depthLimit: options.depthLimit,
     onParse: options.onParse,
     onError: options.onError,
     onDone: options.onDone,
@@ -183,6 +184,7 @@ export function fromCrossJSON<T>(
     refs: options.refs,
     features: options.features,
     disabledFeatures: options.disabledFeatures,
+    depthLimit: options.depthLimit,
   });
   return deserializeTop(ctx, source) as T;
 }

packages/seroval/test/async-iterable.test.ts

@@ -21,6 +21,16 @@ const EXAMPLE = {
   },
 };
 
+function makeDeepObject(depth: number): Record<string, unknown> {
+  let current: Record<string, unknown> = {};
+  const root = current;
+  for (let i = 0; i < depth; i++) {
+    current.next = {};
+    current = current.next as Record<string, unknown>;
+  }
+  return root;
+}
+
 describe('AsyncIterable', () => {
   describe('serializeAsync', () => {
     it('supports AsyncIterables', async () => {
@@ -125,5 +135,22 @@ describe('AsyncIterable', () => {
           },
         });
       }));
+    it('respects depthLimit', async () =>
+      new Promise<void>(resolve => {
+        const deep = makeDeepObject(5);
+        let parsed = false;
+        toCrossJSONStream(deep, {
+          depthLimit: 2,
+          onParse() {
+            parsed = true;
+          },
+          onError(error) {
+            expect(error).toBeInstanceOf(Error);
+            expect((error as Error).message).toContain('Depth limit');
+            expect(parsed).toBe(false);
+            resolve();
+          },
+        });
+      }));
   });
 });

packages/seroval/test/iterable.test.ts

@@ -24,6 +24,16 @@ const EXAMPLE = {
   },
 };
 
+function makeDeepObject(depth: number): Record<string, unknown> {
+  let current: Record<string, unknown> = {};
+  const root = current;
+  for (let i = 0; i < depth; i++) {
+    current.next = {};
+    current = current.next as Record<string, unknown>;
+  }
+  return root;
+}
+
 describe('Iterable', () => {
   describe('serialize', () => {
     it('supports Iterables', () => {
@@ -181,5 +191,34 @@ describe('Iterable', () => {
           },
         });
       }));
+    it('respects depthLimit', async () =>
+      new Promise<void>(resolve => {
+        const deep = makeDeepObject(5);
+        let parsed = false;
+        toCrossJSONStream(deep, {
+          depthLimit: 2,
+          onParse() {
+            parsed = true;
+          },
+          onError(error) {
+            expect(error).toBeInstanceOf(Error);
+            expect((error as Error).message).toContain('Depth limit');
+            expect(parsed).toBe(false);
+            resolve();
+          },
+        });
+      }));
+  });
+  describe('fromCrossJSON', () => {
+    it('respects depthLimit', () => {
+      const deep = makeDeepObject(5);
+      const tree = toCrossJSON(deep);
+      expect(() =>
+        fromCrossJSON(tree, {
+          depthLimit: 2,
+          refs: new Map(),
+        }),
+      ).toThrowError(/Depth limit/);
+    });
   });
 });