Make deserialization more explicit in usage example

Author: DeveloperHarris

README.md

@@ -2,31 +2,31 @@
 
 Like `JSON.stringify`, but handles
 
-- cyclical references (`obj.self = obj`)
-- repeated references (`[value, value]`)
-- `undefined`, `Infinity`, `NaN`, `-0`
-- regular expressions
-- dates
-- `Map` and `Set`
-- `BigInt`
+-   cyclical references (`obj.self = obj`)
+-   repeated references (`[value, value]`)
+-   `undefined`, `Infinity`, `NaN`, `-0`
+-   regular expressions
+-   dates
+-   `Map` and `Set`
+-   `BigInt`
 
 Try it out [here](https://svelte.dev/repl/138d70def7a748ce9eda736ef1c71239?version=3.49.0).
 
 ## Goals:
 
-- Performance
-- Security (see [XSS mitigation](#xss-mitigation))
-- Compact output
+-   Performance
+-   Security (see [XSS mitigation](#xss-mitigation))
+-   Compact output
 
 ## Non-goals:
 
-- Human-readable output
-- Stringifying functions or non-POJOs
+-   Human-readable output
+-   Stringifying functions or non-POJOs
 
 ## Usage
 
 ```js
-import { devalue } from 'devalue';
+import { devalue } from "devalue";
 
 let obj = { a: 1, b: 2 };
 obj.c = 3;
@@ -35,6 +35,9 @@ devalue(obj); // '{a:1,b:2,c:3}'
 
 obj.self = obj;
 devalue(obj); // '(function(a){a.a=1;a.b=2;a.c=3;a.self=a;return a}({}))'
+
+// Deserialize into new object
+let newObject = (0, eval)("(" + devalue(obj) + ")");
 ```
 
 ## Error handling
@@ -43,16 +46,16 @@ If `devalue` encounters a function or a non-POJO, it will throw an error. You ca
 
 ```js
 try {
-  const map = new Map();
-  map.set('key', function invalid() {});
-
-  devalue({
-    object: {
-      array: [map]
-    }
-  })
+    const map = new Map();
+    map.set("key", function invalid() {});
+
+    devalue({
+        object: {
+            array: [map],
+        },
+    });
 } catch (e) {
-  console.log(e.path); // '.object.array[0].get("key")'
+    console.log(e.path); // '.object.array[0].get("key")'
 }
 ```
 
@@ -62,7 +65,7 @@ Say you're server-rendering a page and want to serialize some state, which could
 
 ```js
 const state = {
-  userinput: `</script><script src='https://evil.com/mwahaha.js'>`
+    userinput: `</script><script src='https://evil.com/mwahaha.js'>`,
 };
 
 const template = `
@@ -76,11 +79,11 @@ Which would result in this:
 
 ```html
 <script>
-  // NEVER DO THIS
-  var preloaded = {"userinput":"
+    // NEVER DO THIS
+    var preloaded = {"userinput":"
 </script>
 <script src="https://evil.com/mwahaha.js">
-  "};
+    "};
 </script>
 ```
 
@@ -95,17 +98,17 @@ const template = `
 
 ```html
 <script>
-  var preloaded = {
-    userinput:
-      "\\u003C\\u002Fscript\\u003E\\u003Cscript src='https:\\u002F\\u002Fevil.com\\u002Fmwahaha.js'\\u003E"
-  };
+    var preloaded = {
+        userinput:
+            "\\u003C\\u002Fscript\\u003E\\u003Cscript src='https:\\u002F\\u002Fevil.com\\u002Fmwahaha.js'\\u003E",
+    };
 </script>
 ```
 
 This, along with the fact that `devalue` bails on functions and non-POJOs, stops attackers from executing arbitrary code. Strings generated by `devalue` can be safely deserialized with `eval` or `new Function`:
 
 ```js
-const value = (0, eval)('(' + str + ')');
+const value = (0, eval)("(" + str + ")");
 ```
 
 ## Other security considerations
@@ -116,22 +119,22 @@ When using `eval`, ensure that you call it _indirectly_ so that the evaluated co
 
 ```js
 {
-  const sensitiveData = 'Setec Astronomy';
-  eval('sendToEvilServer(sensitiveData)'); // pwned :(
-  (0, eval)('sendToEvilServer(sensitiveData)'); // nice try, evildoer!
+    const sensitiveData = "Setec Astronomy";
+    eval("sendToEvilServer(sensitiveData)"); // pwned :(
+    (0, eval)("sendToEvilServer(sensitiveData)"); // nice try, evildoer!
 }
 ```
 
 Using `new Function(code)` is akin to using indirect eval.
 
 ## See also
 
-- [lave](https://github.com/jed/lave) by Jed Schmidt
-- [arson](https://github.com/benjamn/arson) by Ben Newman
-- [tosource](https://github.com/marcello3d/node-tosource) by Marcello Bastéa-Forte
-- [serialize-javascript](https://github.com/yahoo/serialize-javascript) by Eric Ferraiuolo
-- [jsesc](https://github.com/mathiasbynens/jsesc) by Mathias Bynens
-- [superjson](https://github.com/blitz-js/superjson) by Blitz
+-   [lave](https://github.com/jed/lave) by Jed Schmidt
+-   [arson](https://github.com/benjamn/arson) by Ben Newman
+-   [tosource](https://github.com/marcello3d/node-tosource) by Marcello Bastéa-Forte
+-   [serialize-javascript](https://github.com/yahoo/serialize-javascript) by Eric Ferraiuolo
+-   [jsesc](https://github.com/mathiasbynens/jsesc) by Mathias Bynens
+-   [superjson](https://github.com/blitz-js/superjson) by Blitz
 
 ## License