fix(search): reject inherited JSON serializers

Author: waleedlatif1

apps/sim/lib/core/utils/bounded-json.test.ts

@@ -103,4 +103,20 @@ describe('bounded JSON', () => {
     expect(isJsonWithinByteLimit(value, bytes)).toBe(true)
     expect(isJsonWithinByteLimit(value, bytes - 1)).toBe(false)
   })
+
+  it.each(['method', 'accessor'] as const)(
+    'rejects an inherited toJSON %s without invoking it or ignoring an own shadow',
+    (kind) => {
+      const serialize = vi.fn(() => 'x'.repeat(2048))
+      const prototype = Object.create(Array.prototype, {
+        toJSON: kind === 'method' ? { value: serialize } : { get: serialize },
+      })
+      const value = Object.setPrototypeOf([], Object.create(prototype))
+      expect(isJsonWithinByteLimit(value, 1024)).toBe(false)
+      expect(serialize).not.toHaveBeenCalled()
+      Object.defineProperty(value, 'toJSON', { value: null })
+      expect(isJsonWithinByteLimit(value, 2)).toBe(true)
+      expect(serialize).not.toHaveBeenCalled()
+    }
+  )
 })

apps/sim/lib/core/utils/bounded-json.ts

@@ -76,9 +76,12 @@ export function isJsonWithinByteLimit(value: unknown, maxBytes: number): boolean
         const prototype = Object.getPrototypeOf(item)
         if (!Array.isArray(item) && prototype !== Object.prototype && prototype !== null)
           return false
-        const serializer = Object.getOwnPropertyDescriptor(item, 'toJSON')
-        if (serializer && (!('value' in serializer) || typeof serializer.value === 'function'))
-          return false
+        for (let owner: object | null = item; owner; owner = Object.getPrototypeOf(owner)) {
+          const serializer = Object.getOwnPropertyDescriptor(owner, 'toJSON')
+          if (!serializer) continue
+          if (!('value' in serializer) || typeof serializer.value === 'function') return false
+          break
+        }
         bytes += 2
         ancestors.add(item)
         stack.push({ value: item, entries: entries(item), count: 0 })