Security: SafeKey XSS

[JohannesLamberts]

As shown in vuejs/vuex-router-sync#89 (comment) and https://codesandbox.io/s/5x2wpo27k4, devalue exposes a XSS vulnerability, when an object key contains unsafe characters.

From the issue:

I think it should be safe to use the same approach as in serialize-javascript to replace unsafe characters: https://github.com/yahoo/serialize-javascript/blob/35f64803a3a67662e16ad5260901d4e291260989/index.js#L126

[pi0]

Simpler reproduction:

• https://r5j8kwq3mp.codesandbox.io
• https://codesandbox.io/s/r5j8kwq3mp

Server-side (express + query):

• https://v6j0vwkjo5.sse.codesandbox.io/?%3Csvg%20onload%3dalert(%27xss_works%27)%3E
• https://codesandbox.io/s/v6j0vwkjo5

[Rich-Harris]

Thank you for finding/fixing this — bit embarrassed about how long it went unmerged, but this is now released as 1.1.1