From e78e301da36f5648e049993be5a630aaf6f3ad1c Mon Sep 17 00:00:00 2001
From: Agi-Asi <206806952+Agi-Asi@users.noreply.github.com>
Date: Fri, 28 Aug 2026 07:40:21 +0000
Subject: [PATCH] fix(devtools-kit): guard SuperJSON.parse against non-string
 message payloads

When a message event carries a non-string payload (e.g. an object posted
to a shared BroadcastChannel, or a window message whose payload is not a
JSON string), SuperJSON.parse throws an uncaught
"SyntaxError: \"[object Object]\" is not valid JSON". This shows up in the
console as an unhandled error while DevTools is running.

Only attempt to parse the payload when it is a string, otherwise ignore the
message. This makes the broadcast, extension-server and Vite messaging
channels resilient to foreign messages on shared channels.

Closes #911
---
 .../src/messaging/presets/broadcast-channel/index.ts         | 5 +++++
 .../devtools-kit/src/messaging/presets/extension/server.ts   | 2 +-
 packages/devtools-kit/src/messaging/presets/vite/client.ts   | 4 ++++
 packages/devtools-kit/src/messaging/presets/vite/server.ts   | 4 ++++
 4 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/packages/devtools-kit/src/messaging/presets/broadcast-channel/index.ts b/packages/devtools-kit/src/messaging/presets/broadcast-channel/index.ts
index 53db9d1b4..7578747ce 100644
--- a/packages/devtools-kit/src/messaging/presets/broadcast-channel/index.ts
+++ b/packages/devtools-kit/src/messaging/presets/broadcast-channel/index.ts
@@ -16,6 +16,11 @@ export function createBroadcastChannel(): MergeableChannelOptions {
     },
     on: (handler) => {
       channel.onmessage = (event) => {
+        // The channel can receive payloads that are not JSON strings (e.g. an
+        // object) when it is shared with other code. Parsing a non-string
+        // value throws `SyntaxError: "[object Object]" is not valid JSON`.
+        if (typeof event.data !== 'string')
+          return
         const parsed = SuperJSON.parse<{ event: string, data: unknown }>(event.data)
         if (parsed.event === __DEVTOOLS_KIT_BROADCAST_MESSAGING_EVENT_KEY) {
           handler(parsed.data)
diff --git a/packages/devtools-kit/src/messaging/presets/extension/server.ts b/packages/devtools-kit/src/messaging/presets/extension/server.ts
index a9367dd83..23ba7c271 100644
--- a/packages/devtools-kit/src/messaging/presets/extension/server.ts
+++ b/packages/devtools-kit/src/messaging/presets/extension/server.ts
@@ -12,7 +12,7 @@ export function createExtensionServerChannel(): MergeableChannelOptions {
     },
     on: (handler) => {
       const listener = (event: MessageEvent) => {
-        if (event.data.source === __DEVTOOLS_KIT_EXTENSION_MESSAGING_EVENT_KEY__.PROXY_TO_SERVER && event.data.payload) {
+        if (event.data.source === __DEVTOOLS_KIT_EXTENSION_MESSAGING_EVENT_KEY__.PROXY_TO_SERVER && typeof event.data.payload === 'string') {
           handler(SuperJSON.parse(event.data.payload))
         }
       }
diff --git a/packages/devtools-kit/src/messaging/presets/vite/client.ts b/packages/devtools-kit/src/messaging/presets/vite/client.ts
index 188226118..ae9a803db 100644
--- a/packages/devtools-kit/src/messaging/presets/vite/client.ts
+++ b/packages/devtools-kit/src/messaging/presets/vite/client.ts
@@ -10,6 +10,10 @@ export function createViteClientChannel(): MergeableChannelOptions {
     },
     on: (handler) => {
       client?.on(__DEVTOOLS_KIT_VITE_MESSAGING_EVENT_KEY, (event) => {
+        // Only parse string payloads; parsing an object/other value throws
+        // `SyntaxError: "[object Object]" is not valid JSON`.
+        if (typeof event !== 'string')
+          return
         handler(SuperJSON.parse(event))
       })
     },
diff --git a/packages/devtools-kit/src/messaging/presets/vite/server.ts b/packages/devtools-kit/src/messaging/presets/vite/server.ts
index bcfad9979..b52955273 100644
--- a/packages/devtools-kit/src/messaging/presets/vite/server.ts
+++ b/packages/devtools-kit/src/messaging/presets/vite/server.ts
@@ -10,6 +10,10 @@ export function createViteServerChannel(): MergeableChannelOptions {
   return {
     post: data => ws?.send(__DEVTOOLS_KIT_VITE_MESSAGING_EVENT_KEY, SuperJSON.stringify(data)),
     on: handler => ws?.on(__DEVTOOLS_KIT_VITE_MESSAGING_EVENT_KEY, (event) => {
+      // Only parse string payloads; parsing an object/other value throws
+      // `SyntaxError: "[object Object]" is not valid JSON`.
+      if (typeof event !== 'string')
+        return
       handler(SuperJSON.parse(event))
     }),
   }