@augustofarnese/qs-patch 6.15.0-patched.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.editorconfig +46 -0
- package/.github/FUNDING.yml +12 -0
- package/.github/SECURITY.md +11 -0
- package/.github/THREAT_MODEL.md +78 -0
- package/.nycrc +13 -0
- package/CHANGELOG.md +806 -0
- package/LICENSE.md +29 -0
- package/README.md +758 -0
- package/dist/qs.js +141 -0
- package/eslint.config.mjs +56 -0
- package/lib/formats.js +23 -0
- package/lib/index.js +11 -0
- package/lib/parse.js +373 -0
- package/lib/stringify.js +356 -0
- package/lib/utils.js +342 -0
- package/package.json +90 -0
- package/test/empty-keys-cases.js +267 -0
- package/test/parse.js +1568 -0
- package/test/stringify.js +1310 -0
- package/test/utils.js +404 -0
package/lib/parse.js
ADDED
|
@@ -0,0 +1,373 @@
|
|
|
1
|
+
'use strict';
|
|
2
|
+
|
|
3
|
+
var utils = require('./utils');
|
|
4
|
+
|
|
5
|
+
var has = Object.prototype.hasOwnProperty;
|
|
6
|
+
var isArray = Array.isArray;
|
|
7
|
+
|
|
8
|
+
var defaults = {
|
|
9
|
+
allowDots: false,
|
|
10
|
+
allowEmptyArrays: false,
|
|
11
|
+
allowPrototypes: false,
|
|
12
|
+
allowSparse: false,
|
|
13
|
+
arrayLimit: 20,
|
|
14
|
+
charset: 'utf-8',
|
|
15
|
+
charsetSentinel: false,
|
|
16
|
+
comma: false,
|
|
17
|
+
decodeDotInKeys: false,
|
|
18
|
+
decoder: utils.decode,
|
|
19
|
+
delimiter: '&',
|
|
20
|
+
depth: 5,
|
|
21
|
+
duplicates: 'combine',
|
|
22
|
+
ignoreQueryPrefix: false,
|
|
23
|
+
interpretNumericEntities: false,
|
|
24
|
+
parameterLimit: 1000,
|
|
25
|
+
parseArrays: true,
|
|
26
|
+
plainObjects: false,
|
|
27
|
+
strictDepth: false,
|
|
28
|
+
strictMerge: true,
|
|
29
|
+
strictNullHandling: false,
|
|
30
|
+
throwOnLimitExceeded: false
|
|
31
|
+
};
|
|
32
|
+
|
|
33
|
+
var interpretNumericEntities = function (str) {
|
|
34
|
+
return str.replace(/&#(\d+);/g, function ($0, numberStr) {
|
|
35
|
+
return String.fromCharCode(parseInt(numberStr, 10));
|
|
36
|
+
});
|
|
37
|
+
};
|
|
38
|
+
|
|
39
|
+
var parseArrayValue = function (val, options, currentArrayLength) {
|
|
40
|
+
if (val && typeof val === 'string' && options.comma && val.indexOf(',') > -1) {
|
|
41
|
+
return val.split(',');
|
|
42
|
+
}
|
|
43
|
+
|
|
44
|
+
if (options.throwOnLimitExceeded && currentArrayLength >= options.arrayLimit) {
|
|
45
|
+
throw new RangeError('Array limit exceeded. Only ' + options.arrayLimit + ' element' + (options.arrayLimit === 1 ? '' : 's') + ' allowed in an array.');
|
|
46
|
+
}
|
|
47
|
+
|
|
48
|
+
return val;
|
|
49
|
+
};
|
|
50
|
+
|
|
51
|
+
// This is what browsers will submit when the ✓ character occurs in an
|
|
52
|
+
// application/x-www-form-urlencoded body and the encoding of the page containing
|
|
53
|
+
// the form is iso-8859-1, or when the submitted form has an accept-charset
|
|
54
|
+
// attribute of iso-8859-1. Presumably also with other charsets that do not contain
|
|
55
|
+
// the ✓ character, such as us-ascii.
|
|
56
|
+
var isoSentinel = 'utf8=%26%2310003%3B'; // encodeURIComponent('✓')
|
|
57
|
+
|
|
58
|
+
// These are the percent-encoded utf-8 octets representing a checkmark, indicating that the request actually is utf-8 encoded.
|
|
59
|
+
var charsetSentinel = 'utf8=%E2%9C%93'; // encodeURIComponent('✓')
|
|
60
|
+
|
|
61
|
+
var parseValues = function parseQueryStringValues(str, options) {
|
|
62
|
+
var obj = { __proto__: null };
|
|
63
|
+
|
|
64
|
+
var cleanStr = options.ignoreQueryPrefix ? str.replace(/^\?/, '') : str;
|
|
65
|
+
cleanStr = cleanStr.replace(/%5B/gi, '[').replace(/%5D/gi, ']');
|
|
66
|
+
|
|
67
|
+
var limit = options.parameterLimit === Infinity ? void undefined : options.parameterLimit;
|
|
68
|
+
var parts = cleanStr.split(
|
|
69
|
+
options.delimiter,
|
|
70
|
+
options.throwOnLimitExceeded ? limit + 1 : limit
|
|
71
|
+
);
|
|
72
|
+
|
|
73
|
+
if (options.throwOnLimitExceeded && parts.length > limit) {
|
|
74
|
+
throw new RangeError('Parameter limit exceeded. Only ' + limit + ' parameter' + (limit === 1 ? '' : 's') + ' allowed.');
|
|
75
|
+
}
|
|
76
|
+
|
|
77
|
+
var skipIndex = -1; // Keep track of where the utf8 sentinel was found
|
|
78
|
+
var i;
|
|
79
|
+
|
|
80
|
+
var charset = options.charset;
|
|
81
|
+
if (options.charsetSentinel) {
|
|
82
|
+
for (i = 0; i < parts.length; ++i) {
|
|
83
|
+
if (parts[i].indexOf('utf8=') === 0) {
|
|
84
|
+
if (parts[i] === charsetSentinel) {
|
|
85
|
+
charset = 'utf-8';
|
|
86
|
+
} else if (parts[i] === isoSentinel) {
|
|
87
|
+
charset = 'iso-8859-1';
|
|
88
|
+
}
|
|
89
|
+
skipIndex = i;
|
|
90
|
+
i = parts.length; // The eslint settings do not allow break;
|
|
91
|
+
}
|
|
92
|
+
}
|
|
93
|
+
}
|
|
94
|
+
|
|
95
|
+
for (i = 0; i < parts.length; ++i) {
|
|
96
|
+
if (i === skipIndex) {
|
|
97
|
+
continue;
|
|
98
|
+
}
|
|
99
|
+
var part = parts[i];
|
|
100
|
+
|
|
101
|
+
var bracketEqualsPos = part.indexOf(']=');
|
|
102
|
+
var pos = bracketEqualsPos === -1 ? part.indexOf('=') : bracketEqualsPos + 1;
|
|
103
|
+
|
|
104
|
+
var key;
|
|
105
|
+
var val;
|
|
106
|
+
if (pos === -1) {
|
|
107
|
+
key = options.decoder(part, defaults.decoder, charset, 'key');
|
|
108
|
+
val = options.strictNullHandling ? null : '';
|
|
109
|
+
} else {
|
|
110
|
+
key = options.decoder(part.slice(0, pos), defaults.decoder, charset, 'key');
|
|
111
|
+
|
|
112
|
+
if (key !== null) {
|
|
113
|
+
val = utils.maybeMap(
|
|
114
|
+
parseArrayValue(
|
|
115
|
+
part.slice(pos + 1),
|
|
116
|
+
options,
|
|
117
|
+
isArray(obj[key]) ? obj[key].length : 0
|
|
118
|
+
),
|
|
119
|
+
function (encodedVal) {
|
|
120
|
+
return options.decoder(encodedVal, defaults.decoder, charset, 'value');
|
|
121
|
+
}
|
|
122
|
+
);
|
|
123
|
+
}
|
|
124
|
+
}
|
|
125
|
+
|
|
126
|
+
if (val && options.interpretNumericEntities && charset === 'iso-8859-1') {
|
|
127
|
+
val = interpretNumericEntities(String(val));
|
|
128
|
+
}
|
|
129
|
+
|
|
130
|
+
if (part.indexOf('[]=') > -1) {
|
|
131
|
+
val = isArray(val) ? [val] : val;
|
|
132
|
+
}
|
|
133
|
+
|
|
134
|
+
if (options.comma && isArray(val) && val.length > options.arrayLimit) {
|
|
135
|
+
if (options.throwOnLimitExceeded) {
|
|
136
|
+
throw new RangeError('Array limit exceeded. Only ' + options.arrayLimit + ' element' + (options.arrayLimit === 1 ? '' : 's') + ' allowed in an array.');
|
|
137
|
+
}
|
|
138
|
+
val = utils.combine([], val, options.arrayLimit, options.plainObjects);
|
|
139
|
+
}
|
|
140
|
+
|
|
141
|
+
if (key !== null) {
|
|
142
|
+
var existing = has.call(obj, key);
|
|
143
|
+
if (existing && (options.duplicates === 'combine' || part.indexOf('[]=') > -1)) {
|
|
144
|
+
obj[key] = utils.combine(
|
|
145
|
+
obj[key],
|
|
146
|
+
val,
|
|
147
|
+
options.arrayLimit,
|
|
148
|
+
options.plainObjects
|
|
149
|
+
);
|
|
150
|
+
} else if (!existing || options.duplicates === 'last') {
|
|
151
|
+
obj[key] = val;
|
|
152
|
+
}
|
|
153
|
+
}
|
|
154
|
+
}
|
|
155
|
+
|
|
156
|
+
return obj;
|
|
157
|
+
};
|
|
158
|
+
|
|
159
|
+
var parseObject = function (chain, val, options, valuesParsed) {
|
|
160
|
+
var currentArrayLength = 0;
|
|
161
|
+
if (chain.length > 0 && chain[chain.length - 1] === '[]') {
|
|
162
|
+
var parentKey = chain.slice(0, -1).join('');
|
|
163
|
+
currentArrayLength = Array.isArray(val) && val[parentKey] ? val[parentKey].length : 0;
|
|
164
|
+
}
|
|
165
|
+
|
|
166
|
+
var leaf = valuesParsed ? val : parseArrayValue(val, options, currentArrayLength);
|
|
167
|
+
|
|
168
|
+
for (var i = chain.length - 1; i >= 0; --i) {
|
|
169
|
+
var obj;
|
|
170
|
+
var root = chain[i];
|
|
171
|
+
|
|
172
|
+
if (root === '[]' && options.parseArrays) {
|
|
173
|
+
if (utils.isOverflow(leaf)) {
|
|
174
|
+
// leaf is already an overflow object, preserve it
|
|
175
|
+
obj = leaf;
|
|
176
|
+
} else {
|
|
177
|
+
obj = options.allowEmptyArrays && (leaf === '' || (options.strictNullHandling && leaf === null))
|
|
178
|
+
? []
|
|
179
|
+
: utils.combine(
|
|
180
|
+
[],
|
|
181
|
+
leaf,
|
|
182
|
+
options.arrayLimit,
|
|
183
|
+
options.plainObjects
|
|
184
|
+
);
|
|
185
|
+
}
|
|
186
|
+
} else {
|
|
187
|
+
obj = options.plainObjects ? { __proto__: null } : {};
|
|
188
|
+
var cleanRoot = root.charAt(0) === '[' && root.charAt(root.length - 1) === ']' ? root.slice(1, -1) : root;
|
|
189
|
+
var decodedRoot = options.decodeDotInKeys ? cleanRoot.replace(/%2E/g, '.') : cleanRoot;
|
|
190
|
+
var index = parseInt(decodedRoot, 10);
|
|
191
|
+
var isValidArrayIndex = !isNaN(index)
|
|
192
|
+
&& root !== decodedRoot
|
|
193
|
+
&& String(index) === decodedRoot
|
|
194
|
+
&& index >= 0
|
|
195
|
+
&& options.parseArrays;
|
|
196
|
+
if (!options.parseArrays && decodedRoot === '') {
|
|
197
|
+
obj = { 0: leaf };
|
|
198
|
+
} else if (isValidArrayIndex && index < options.arrayLimit) {
|
|
199
|
+
obj = [];
|
|
200
|
+
obj[index] = leaf;
|
|
201
|
+
} else if (isValidArrayIndex && options.throwOnLimitExceeded) {
|
|
202
|
+
throw new RangeError('Array limit exceeded. Only ' + options.arrayLimit + ' element' + (options.arrayLimit === 1 ? '' : 's') + ' allowed in an array.');
|
|
203
|
+
} else if (isValidArrayIndex) {
|
|
204
|
+
obj[index] = leaf;
|
|
205
|
+
utils.markOverflow(obj, index);
|
|
206
|
+
} else if (decodedRoot !== '__proto__') {
|
|
207
|
+
obj[decodedRoot] = leaf;
|
|
208
|
+
}
|
|
209
|
+
}
|
|
210
|
+
|
|
211
|
+
leaf = obj;
|
|
212
|
+
}
|
|
213
|
+
|
|
214
|
+
return leaf;
|
|
215
|
+
};
|
|
216
|
+
|
|
217
|
+
var splitKeyIntoSegments = function splitKeyIntoSegments(givenKey, options) {
|
|
218
|
+
var key = options.allowDots ? givenKey.replace(/\.([^.[]+)/g, '[$1]') : givenKey;
|
|
219
|
+
|
|
220
|
+
if (options.depth <= 0) {
|
|
221
|
+
if (!options.plainObjects && has.call(Object.prototype, key)) {
|
|
222
|
+
if (!options.allowPrototypes) {
|
|
223
|
+
return;
|
|
224
|
+
}
|
|
225
|
+
}
|
|
226
|
+
|
|
227
|
+
return [key];
|
|
228
|
+
}
|
|
229
|
+
|
|
230
|
+
var brackets = /(\[[^[\]]*])/;
|
|
231
|
+
var child = /(\[[^[\]]*])/g;
|
|
232
|
+
|
|
233
|
+
var segment = brackets.exec(key);
|
|
234
|
+
var parent = segment ? key.slice(0, segment.index) : key;
|
|
235
|
+
|
|
236
|
+
var keys = [];
|
|
237
|
+
|
|
238
|
+
if (parent) {
|
|
239
|
+
if (!options.plainObjects && has.call(Object.prototype, parent)) {
|
|
240
|
+
if (!options.allowPrototypes) {
|
|
241
|
+
return;
|
|
242
|
+
}
|
|
243
|
+
}
|
|
244
|
+
|
|
245
|
+
keys[keys.length] = parent;
|
|
246
|
+
}
|
|
247
|
+
|
|
248
|
+
var i = 0;
|
|
249
|
+
while ((segment = child.exec(key)) !== null && i < options.depth) {
|
|
250
|
+
i += 1;
|
|
251
|
+
|
|
252
|
+
var segmentContent = segment[1].slice(1, -1);
|
|
253
|
+
if (!options.plainObjects && has.call(Object.prototype, segmentContent)) {
|
|
254
|
+
if (!options.allowPrototypes) {
|
|
255
|
+
return;
|
|
256
|
+
}
|
|
257
|
+
}
|
|
258
|
+
|
|
259
|
+
keys[keys.length] = segment[1];
|
|
260
|
+
}
|
|
261
|
+
|
|
262
|
+
if (segment) {
|
|
263
|
+
if (options.strictDepth === true) {
|
|
264
|
+
throw new RangeError('Input depth exceeded depth option of ' + options.depth + ' and strictDepth is true');
|
|
265
|
+
}
|
|
266
|
+
|
|
267
|
+
keys[keys.length] = '[' + key.slice(segment.index) + ']';
|
|
268
|
+
}
|
|
269
|
+
|
|
270
|
+
return keys;
|
|
271
|
+
};
|
|
272
|
+
|
|
273
|
+
var parseKeys = function parseQueryStringKeys(givenKey, val, options, valuesParsed) {
|
|
274
|
+
if (!givenKey) {
|
|
275
|
+
return;
|
|
276
|
+
}
|
|
277
|
+
|
|
278
|
+
var keys = splitKeyIntoSegments(givenKey, options);
|
|
279
|
+
|
|
280
|
+
if (!keys) {
|
|
281
|
+
return;
|
|
282
|
+
}
|
|
283
|
+
|
|
284
|
+
return parseObject(keys, val, options, valuesParsed);
|
|
285
|
+
};
|
|
286
|
+
|
|
287
|
+
var normalizeParseOptions = function normalizeParseOptions(opts) {
|
|
288
|
+
if (!opts) {
|
|
289
|
+
return defaults;
|
|
290
|
+
}
|
|
291
|
+
|
|
292
|
+
if (typeof opts.allowEmptyArrays !== 'undefined' && typeof opts.allowEmptyArrays !== 'boolean') {
|
|
293
|
+
throw new TypeError('`allowEmptyArrays` option can only be `true` or `false`, when provided');
|
|
294
|
+
}
|
|
295
|
+
|
|
296
|
+
if (typeof opts.decodeDotInKeys !== 'undefined' && typeof opts.decodeDotInKeys !== 'boolean') {
|
|
297
|
+
throw new TypeError('`decodeDotInKeys` option can only be `true` or `false`, when provided');
|
|
298
|
+
}
|
|
299
|
+
|
|
300
|
+
if (opts.decoder !== null && typeof opts.decoder !== 'undefined' && typeof opts.decoder !== 'function') {
|
|
301
|
+
throw new TypeError('Decoder has to be a function.');
|
|
302
|
+
}
|
|
303
|
+
|
|
304
|
+
if (typeof opts.charset !== 'undefined' && opts.charset !== 'utf-8' && opts.charset !== 'iso-8859-1') {
|
|
305
|
+
throw new TypeError('The charset option must be either utf-8, iso-8859-1, or undefined');
|
|
306
|
+
}
|
|
307
|
+
|
|
308
|
+
if (typeof opts.throwOnLimitExceeded !== 'undefined' && typeof opts.throwOnLimitExceeded !== 'boolean') {
|
|
309
|
+
throw new TypeError('`throwOnLimitExceeded` option must be a boolean');
|
|
310
|
+
}
|
|
311
|
+
|
|
312
|
+
var charset = typeof opts.charset === 'undefined' ? defaults.charset : opts.charset;
|
|
313
|
+
|
|
314
|
+
var duplicates = typeof opts.duplicates === 'undefined' ? defaults.duplicates : opts.duplicates;
|
|
315
|
+
|
|
316
|
+
if (duplicates !== 'combine' && duplicates !== 'first' && duplicates !== 'last') {
|
|
317
|
+
throw new TypeError('The duplicates option must be either combine, first, or last');
|
|
318
|
+
}
|
|
319
|
+
|
|
320
|
+
var allowDots = typeof opts.allowDots === 'undefined' ? opts.decodeDotInKeys === true ? true : defaults.allowDots : !!opts.allowDots;
|
|
321
|
+
|
|
322
|
+
return {
|
|
323
|
+
allowDots: allowDots,
|
|
324
|
+
allowEmptyArrays: typeof opts.allowEmptyArrays === 'boolean' ? !!opts.allowEmptyArrays : defaults.allowEmptyArrays,
|
|
325
|
+
allowPrototypes: typeof opts.allowPrototypes === 'boolean' ? opts.allowPrototypes : defaults.allowPrototypes,
|
|
326
|
+
allowSparse: typeof opts.allowSparse === 'boolean' ? opts.allowSparse : defaults.allowSparse,
|
|
327
|
+
arrayLimit: typeof opts.arrayLimit === 'number' ? opts.arrayLimit : defaults.arrayLimit,
|
|
328
|
+
charset: charset,
|
|
329
|
+
charsetSentinel: typeof opts.charsetSentinel === 'boolean' ? opts.charsetSentinel : defaults.charsetSentinel,
|
|
330
|
+
comma: typeof opts.comma === 'boolean' ? opts.comma : defaults.comma,
|
|
331
|
+
decodeDotInKeys: typeof opts.decodeDotInKeys === 'boolean' ? opts.decodeDotInKeys : defaults.decodeDotInKeys,
|
|
332
|
+
decoder: typeof opts.decoder === 'function' ? opts.decoder : defaults.decoder,
|
|
333
|
+
delimiter: typeof opts.delimiter === 'string' || utils.isRegExp(opts.delimiter) ? opts.delimiter : defaults.delimiter,
|
|
334
|
+
// eslint-disable-next-line no-implicit-coercion, no-extra-parens
|
|
335
|
+
depth: (typeof opts.depth === 'number' || opts.depth === false) ? +opts.depth : defaults.depth,
|
|
336
|
+
duplicates: duplicates,
|
|
337
|
+
ignoreQueryPrefix: opts.ignoreQueryPrefix === true,
|
|
338
|
+
interpretNumericEntities: typeof opts.interpretNumericEntities === 'boolean' ? opts.interpretNumericEntities : defaults.interpretNumericEntities,
|
|
339
|
+
parameterLimit: typeof opts.parameterLimit === 'number' ? opts.parameterLimit : defaults.parameterLimit,
|
|
340
|
+
parseArrays: opts.parseArrays !== false,
|
|
341
|
+
plainObjects: typeof opts.plainObjects === 'boolean' ? opts.plainObjects : defaults.plainObjects,
|
|
342
|
+
strictDepth: typeof opts.strictDepth === 'boolean' ? !!opts.strictDepth : defaults.strictDepth,
|
|
343
|
+
strictMerge: typeof opts.strictMerge === 'boolean' ? !!opts.strictMerge : defaults.strictMerge,
|
|
344
|
+
strictNullHandling: typeof opts.strictNullHandling === 'boolean' ? opts.strictNullHandling : defaults.strictNullHandling,
|
|
345
|
+
throwOnLimitExceeded: typeof opts.throwOnLimitExceeded === 'boolean' ? opts.throwOnLimitExceeded : false
|
|
346
|
+
};
|
|
347
|
+
};
|
|
348
|
+
|
|
349
|
+
module.exports = function (str, opts) {
|
|
350
|
+
var options = normalizeParseOptions(opts);
|
|
351
|
+
|
|
352
|
+
if (str === '' || str === null || typeof str === 'undefined') {
|
|
353
|
+
return options.plainObjects ? { __proto__: null } : {};
|
|
354
|
+
}
|
|
355
|
+
|
|
356
|
+
var tempObj = typeof str === 'string' ? parseValues(str, options) : str;
|
|
357
|
+
var obj = options.plainObjects ? { __proto__: null } : {};
|
|
358
|
+
|
|
359
|
+
// Iterate over the keys and setup the new object
|
|
360
|
+
|
|
361
|
+
var keys = Object.keys(tempObj);
|
|
362
|
+
for (var i = 0; i < keys.length; ++i) {
|
|
363
|
+
var key = keys[i];
|
|
364
|
+
var newObj = parseKeys(key, tempObj[key], options, typeof str === 'string');
|
|
365
|
+
obj = utils.merge(obj, newObj, options);
|
|
366
|
+
}
|
|
367
|
+
|
|
368
|
+
if (options.allowSparse === true) {
|
|
369
|
+
return obj;
|
|
370
|
+
}
|
|
371
|
+
|
|
372
|
+
return utils.compact(obj);
|
|
373
|
+
};
|