Library API
    Preparing search index...

    Function objectify

    • Rebuilds an Object from its stringify'd string representation. Handles custom single key:value type definitions automatically.

      Type Parameters

      • T

      Parameters

      • str: any

        The string to parse

      • OptionaloptionsOrSentinel: Function | ObjectifyOptions

        Optional configuration options or a sentinel function for undefined values

      Returns T

      The deserialized object or original string if parsing fails

      TRUST BOUNDARY WARNING objectify() is an ACTIVE deserializer designed for internal state persistence (e.g. WebStorage, internal caching, trusted worker IPC).

      Do NOT use objectify() on untrusted or external strings (e.g. HTTP request bodies, unverified tokens, public webhooks):

      • Insecure Deserialization (CWE-502): Can instantiate registered classes via Reflect.construct.
      • Type Confusion: May produce BigInt, Date, or Map where plain JSON values are expected.
      • Global Symbol Pollution: Encoded symbols register into Symbol.for().

      When dealing with semi-trusted strings, configure ObjectifyOptions: set allowClasses: false (or specify an allowedClasses allowlist), maxDepth, or enforce tamper detection with requireSigned: true. For cryptographically authenticated payloads across untrusted network boundaries, use signJWS() / verifyJWS(). For completely untrusted external input, use native JSON.parse() with schema validation instead.

      const obj = objectify('{"$BigInt":"123"}'); // 123n
      const safe = objectify(input, { allowClasses: false, maxDepth: 10 });
      const trusted = objectify(input, { requireSigned: true, secret: 'my-secret' });

    Settings
    Member Visibility