The whole inbound pass in one call: sanitizeInboundText, then JSON.parse with a reviver
that refuses __proto__/constructor/prototype at any depth. Every path in core that
reads JSON it did not just produce goes through this (save slots, Collection, stored
values, LockstepClient messages, NewsClient), because under file:// Chromium gives every
local page one shared localStorage: a value this game wrote can have been rewritten by any
other HTML file opened on the same machine. Throws a named Error for every failure.
The whole inbound pass in one call:
sanitizeInboundText, thenJSON.parsewith a reviver that refuses__proto__/constructor/prototypeat any depth. Every path incorethat reads JSON it did not just produce goes through this (save slots,Collection, stored values,LockstepClientmessages,NewsClient), because underfile://Chromium gives every local page one sharedlocalStorage: a value this game wrote can have been rewritten by any other HTML file opened on the same machine. Throws a namedErrorfor every failure.