refactor(nuxt): replace runInNewContext with AST walker

danielroe · danielroe · commit d72a89ef4519 · 2026-06-02T14:07:03.000+01:00
diff --git a/packages/nuxt/src/pages/utils.ts b/packages/nuxt/src/pages/utils.ts
@@ -1,4 +1,3 @@
-import { runInNewContext } from 'node:vm'
 import fs from 'node:fs'
 import { normalize, relative } from 'pathe'
 import { joinURL } from 'ufo'
@@ -519,51 +518,61 @@ export function resolveRoutePaths (page: NuxtPage, parent = '/'): string[] {
 }
 
 export function isSerializable (code: string, node: Node): { value?: any, serializable: boolean } {
-  if (node.type === 'ObjectExpression') {
-    const valueString = code.slice(node.start, node.end)
-    try {
-      return {
-        value: JSON.parse(runInNewContext(`JSON.stringify(${valueString})`, {})),
-        serializable: true,
-      }
-    } catch {
-      return {
-        serializable: false,
-      }
+  if (node.type === 'Literal') {
+    if (typeof node.value === 'string' || typeof node.value === 'number' || typeof node.value === 'boolean' || node.value === null) {
+      return { value: node.value, serializable: true }
     }
+    return { serializable: false }
+  }
+
+  if (node.type === 'UnaryExpression' && (node.operator === '-' || node.operator === '+')) {
+    const arg = node.argument
+    if (arg.type === 'Literal' && typeof arg.value === 'number') {
+      return { value: node.operator === '-' ? -arg.value : arg.value, serializable: true }
+    }
+    return { serializable: false }
   }
 
   if (node.type === 'ArrayExpression') {
-    const values: string[] = []
+    const values: any[] = []
     for (const element of node.elements) {
-      if (!element) {
-        continue
+      // `null` element is a sparse-array hole.
+      if (!element || element.type === 'SpreadElement') {
+        return { serializable: false }
       }
       const { serializable, value } = isSerializable(code, element)
       if (!serializable) {
-        return {
-          serializable: false,
-        }
+        return { serializable: false }
       }
       values.push(value)
     }
-
-    return {
-      value: values,
-      serializable: true,
-    }
+    return { value: values, serializable: true }
   }
 
-  if (node.type === 'Literal' && (typeof node.value === 'string' || typeof node.value === 'boolean' || typeof node.value === 'number' || node.value === null)) {
-    return {
-      value: node.value,
-      serializable: true,
+  if (node.type === 'ObjectExpression') {
+    const value: Record<string, any> = {}
+    for (const property of node.properties) {
+      if (property.type !== 'Property' || property.computed || property.kind !== 'init' || property.method) {
+        return { serializable: false }
+      }
+      let key: string
+      if (property.key.type === 'Identifier') {
+        key = property.key.name
+      } else if (property.key.type === 'Literal' && (typeof property.key.value === 'string' || typeof property.key.value === 'number')) {
+        key = String(property.key.value)
+      } else {
+        return { serializable: false }
+      }
+      const { serializable, value: propertyValue } = isSerializable(code, property.value)
+      if (!serializable) {
+        return { serializable: false }
+      }
+      value[key] = propertyValue
     }
+    return { value, serializable: true }
   }
 
-  return {
-    serializable: false,
-  }
+  return { serializable: false }
 }
 
 export function toRou3Patterns (pages: NuxtPage[], prefix = '/'): string[] {
diff --git a/packages/nuxt/test/is-serializable.test.ts b/packages/nuxt/test/is-serializable.test.ts
@@ -0,0 +1,110 @@
+import { describe, expect, it } from 'vitest'
+import { parseSync } from 'oxc-parser'
+import type { Expression, VariableDeclaration } from 'oxc-parser'
+
+import { isSerializable } from '../src/pages/utils.ts'
+
+function parseExpression (source: string): { code: string, node: Expression } {
+  // Parse as a variable initialiser so a leading `{` isn't ambiguous with a block, and we get the
+  // raw expression node rather than a ParenthesizedExpression wrapper.
+  const code = `const __x = ${source}`
+  const ast = parseSync('test.js', code, { lang: 'js' })
+  const decl = ast.program.body[0] as VariableDeclaration
+  return { code, node: decl.declarations[0]!.init as Expression }
+}
+
+function check (source: string) {
+  const { code, node } = parseExpression(source)
+  return isSerializable(code, node)
+}
+
+describe('isSerializable', () => {
+  it('accepts a plain literal object', () => {
+    expect(check(`{ foo: 'bar', baz: 1, qux: true, quux: null }`)).toEqual({
+      value: { foo: 'bar', baz: 1, qux: true, quux: null },
+      serializable: true,
+    })
+  })
+
+  it('accepts a nested object containing an array', () => {
+    expect(check(`{ a: { b: [1, 2, 3] } }`)).toEqual({
+      value: { a: { b: [1, 2, 3] } },
+      serializable: true,
+    })
+  })
+
+  it('accepts signed numeric literals', () => {
+    expect(check(`{ x: -1, y: +2 }`)).toEqual({
+      value: { x: -1, y: 2 },
+      serializable: true,
+    })
+  })
+
+  it('accepts string-keyed properties', () => {
+    expect(check(`{ 'foo-bar': 1, '123': 'baz' }`)).toEqual({
+      value: { 'foo-bar': 1, '123': 'baz' },
+      serializable: true,
+    })
+  })
+
+  it('rejects identifier references', () => {
+    expect(check(`{ foo: bar }`)).toEqual({ serializable: false })
+  })
+
+  it('rejects call expressions', () => {
+    expect(check(`{ foo: bar() }`)).toEqual({ serializable: false })
+  })
+
+  it('rejects spread elements in objects', () => {
+    expect(check(`{ ...rest }`)).toEqual({ serializable: false })
+  })
+
+  it('rejects spread elements in arrays', () => {
+    expect(check(`[1, ...rest, 3]`)).toEqual({ serializable: false })
+  })
+
+  it('rejects computed keys', () => {
+    expect(check(`{ [k]: 1 }`)).toEqual({ serializable: false })
+  })
+
+  it('rejects template literals', () => {
+    expect(check('{ foo: `hello` }')).toEqual({ serializable: false })
+  })
+
+  it('rejects regex literals', () => {
+    expect(check(`{ foo: /x/ }`)).toEqual({ serializable: false })
+  })
+
+  it('rejects bigint literals', () => {
+    expect(check(`{ foo: 1n }`)).toEqual({ serializable: false })
+  })
+
+  it('rejects method shorthand', () => {
+    expect(check(`{ foo () {} }`)).toEqual({ serializable: false })
+  })
+
+  it('rejects getters', () => {
+    expect(check(`{ get foo () { return 1 } }`)).toEqual({ serializable: false })
+  })
+
+  it('rejects setters', () => {
+    expect(check(`{ set foo (v) {} }`)).toEqual({ serializable: false })
+  })
+
+  it('rejects sparse arrays', () => {
+    expect(check(`[1, , 3]`)).toEqual({ serializable: false })
+  })
+
+  it('rejects unary operators other than + and -', () => {
+    expect(check(`{ x: !true }`)).toEqual({ serializable: false })
+    expect(check(`{ x: ~1 }`)).toEqual({ serializable: false })
+  })
+
+  it('rejects signed non-numeric literals', () => {
+    expect(check(`{ x: -'foo' }`)).toEqual({ serializable: false })
+  })
+
+  it('rejects arrow function values', () => {
+    expect(check(`{ foo: () => 1 }`)).toEqual({ serializable: false })
+  })
+})
