Summary

This PR backports the security fix introduced in v7.0.3 to the v6.0.2 codebase.

Versions up to v7.0.2 correctly sanitize RegExp.source, but RegExp.flags is still interpolated into generated output without validation or escaping. Additionally, Date.prototype.toISOString() follows the same code path and can be attacker‑controlled.

When serialized output is later evaluated (e.g., via eval, new Function, script injection, etc.), it is possible for malicious values to trigger arbitrary JavaScript execution. This represents an incomplete remediation of the vulnerability originally addressed under CVE‑2020‑7660.

This backport applies the same sanitization and validation logic used in v7.0.3.

Affected Versions

This PR specifically addresses the issue for the v6.x line (based on tag v6.0.2).

Impact

This vulnerability allows improper neutralization of attacker‑controlled values during code generation, resulting in arbitrary JavaScript execution when the serialized output is evaluated.

If an attacker can influence objects passed into serialize(), they can inject code via:

• crafted RegExp.flags
• crafted Date.prototype.toISOString()

This backport ensures that:

• only valid RegExp flag characters are permitted
• unsafe characters and unexpected values are rejected
• invalid ISO date strings are detected and rejected
• attempts at injection do not reach generated output

All new tests from the 7.0.3 fix are included and passing.

Request

Upstream currently maintains only the main branch.

This PR originates from a branch created off the v6.0.2 tag.

Could you please create a 6.0.x maintenance branch?

Once created, I will re‑target this PR so that it merges cleanly into the correct version line.
This will allow you to optionally publish a v6.0.3 release containing this security backport.

Verification

• The patch is a faithful backport of the upstream 7.0.3 fix
• All tests pass, including the newly added security tests
• Behavior matches the latest patched release
• No breaking changes introduced for 6.x users

License

I confirm that this contribution is made under the terms of the license found in the root directory of this repository's source tree and that I have the authority necessary to make this contribution on behalf of its copyright owner.