fix(CVE-2020-7660): fix for RegExp.flags and Date.prototype.toISOString

[redonkulus]

Summary

The fix for CVE-2020-7660 correctly sanitizes RegExp.source, but RegExp.flags is still interpolated directly into generated output without escaping or validation. This enables code injection when serialized output is evaluated.

A similar injection vector exists via Date.prototype.toISOString() on the same code path.

If an attacker can influence objects passed into serialize(), they can inject arbitrary JavaScript that executes when the serialized output is evaluated (e.g., via eval(), new Function(), or embedding in <script> tags).

Affected Versions

All versions from v1.0.0 through v7.0.2 appear to be affected.

Impact

Improper neutralization during code generation allows arbitrary JavaScript execution when the serialized output is evaluated. This represents an incomplete remediation of the vulnerability class originally addressed in CVE-2020-7660.

I confirm that this contribution is made under the terms of the license found in the root directory of this repository's source tree and that I have the authority necessary to make this contribution on behalf of its copyright owner.

[redonkulus]

@okuryu I published an advisory GHSA-5c6j-r48x-rmvq

I also published the release on https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.3