JSON.stringify Edge Cases That Silently Break Production JavaScript Apps

·1 views

JavaScript's JSON.stringify is widely used but carries several silent failure modes that can cause hard-to-trace production bugs. Undefined values, functions, and Symbols are quietly dropped from objects or converted to null in arrays, with no error or warning thrown. Special numeric values like NaN and Infinity are all serialized as null, erasing their original meaning, while Map and Set objects serialize as empty objects by default. Dates serialize correctly only because they implement a toJSON method, a hook developers can use in their own classes. BigInt values are the exception, triggering an outright TypeError rather than a silent conversion, making them easier to catch but still a common stumbling block.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Drupal Web Development in 2026: What Organisations Need to Know

Drupal is a free, open-source CMS that has been in active development for over two decades, now on its 11th major version built on modern PHP and the Symfony framework. It is widely trusted by governments, universities, and large enterprises for projects requiring structured content, complex permissions, and robust security. Unlike WordPress, which prioritises ease of use and suits most small-to-medium sites, Drupal offers greater flexibility and power but comes with a steeper learning curve. Its strengths include fine-grained user roles, strong multilingual support, and the ability to scale without requiring a site rebuild. Organisations are advised to choose Drupal when their project demands complex content modelling and high security, and to consider simpler tools for more straightforward requirements.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

MCP Servers Pose Serious Security Risks as Attackers Exploit Permanent Trust Model

Model Context Protocol (MCP) servers, used to extend AI coding agents with tools and data access, contain critical security vulnerabilities that researchers say are largely unaudited. Once approved, an MCP server retains permanent access to a user's tools, prompts, and data with no re-authentication required. A demonstrated attack chain shows malicious servers behaving normally for the first few interactions before triggering payloads that exfiltrate SSH keys, cloud credentials, and shell history — succeeding roughly 90% of the time in tests against a leading coding agent. A separate technique dubbed 'GhostJacking' embeds hidden instructions inside blocked firewall requests, causing AI agents to unknowingly rewrite DNS settings while reporting the issue as resolved. Security experts recommend treating every MCP server as a privileged access point, keeping DNS and config changes behind human approval, and regularly rotating credentials for any long-running MCP configurations.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why 3D product configurators must calculate prices server-side, not client-side

Client-side price calculation in Three.js product configurators is a critical security flaw, as any user can manipulate the price variable via browser DevTools and submit fraudulent orders. The correct approach separates responsibilities: the frontend displays only a clearly labeled price estimate for a smooth user experience, while the backend independently recalculates the authoritative price at order submission. A recommended 'Confirm order' step fetches the real server-side price before final checkout, eliminating any discrepancy between the preview and the actual charge. The same principle extends to configuration validation, where shared JSON Schema rules provide real-time frontend feedback but the backend serves as the final enforcement gate. This pattern is already used by platforms like Shopify custom apps, Bagisto, and Zakeke to prevent pricing manipulation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Releases Dockerized Vulnerable PHP/MySQL Lab for Web Security Practice

A developer has built and open-sourced a deliberately vulnerable PHP/MySQL application designed for practicing web and API security in a local environment. Unlike typical CTF challenges, the vulnerabilities are modeled on real-world patterns the creator encountered during personal security research. The Dockerized lab includes 10 intentional flaws such as BOLA, JWT forgery, unrestricted file upload leading to remote code execution, and time-based SQL injection. Field manuals are included in the repository to guide users through intended exploit chains if needed. The project is available on GitHub, with a strong caution to run it only in isolated, offline environments and never against unauthorized systems.

0 comments Read more at DEV Community