@openclaw/slack 2026.10.10-beta.5 → 2026.11.5-beta.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/.setup/{account-configured-zcR9TJJN.mjs → account-configured-35y0-Hso.mjs} +1 -2
- package/dist/.setup/{account-inspect-CmkKiSb9.mjs → account-inspect-DgQgj0wk.mjs} +13 -11
- package/dist/.setup/{accounts-msihSF3-.mjs → accounts-EaPP0fFY.mjs} +16 -11
- package/dist/.setup/{action-runtime-ChRfnnBu.mjs → action-runtime-CK9QZgQl.mjs} +39 -47
- package/dist/.setup/action-runtime.runtime-CpZktret.mjs +1 -0
- package/dist/.setup/{actions-By7tvpvv.mjs → actions-s3CcFO45.mjs} +98 -93
- package/dist/.setup/{approval-handler.runtime-D8ArtDQt.mjs → approval-handler.runtime-Ch7BecYK.mjs} +27 -32
- package/dist/.setup/{approval-message-updates-DT7XBPbV.mjs → approval-message-updates-CqcRoa28.mjs} +2 -3
- package/dist/.setup/{channel-6YzXl_63.mjs → channel-CAvo_WNZ.mjs} +573 -352
- package/dist/.setup/{channel-meta-C443t-lI.mjs → channel-meta-C5vsCo3a.mjs} +1 -2
- package/dist/.setup/{channel-type-BEFP2ORi.mjs → channel-type-9Lw6yLf2.mjs} +6 -11
- package/dist/.setup/{channel.setup-u6QQdbTa.mjs → channel.setup-BlgXNuCJ.mjs} +19 -23
- package/dist/.setup/{config-schema-DNnh6bWU.mjs → config-schema-Bx1tCZB0.mjs} +5 -11
- package/dist/.setup/cursor-pages-jVn3Vkfi.mjs +309 -0
- package/dist/.setup/{directory-config-Cjj0N8R0.mjs → directory-config-CGvKYg9F.mjs} +5 -6
- package/dist/.setup/{directory-live-BIKD-5B_.mjs → directory-live-DNdw97LA.mjs} +6 -7
- package/dist/.setup/{doctor-contract-Cd4-VzIM.mjs → doctor-contract-BB2KJ9Ni.mjs} +44 -58
- package/dist/.setup/{message-tool-api-BS5ekEA_.mjs → message-tool-api-B38BpEaE.mjs} +7 -8
- package/dist/.setup/{monitor-BFilOuM_.mjs → monitor-BD86SotB.mjs} +3416 -3750
- package/dist/.setup/{outbound-adapter-9dbnYtL1.mjs → outbound-adapter-BH6iPWBj.mjs} +32 -39
- package/dist/.setup/paths-CQZI_5WY.mjs +7 -0
- package/dist/.setup/{pipeline.runtime-BG5swHnj.mjs → pipeline.runtime-C4ELxaRU.mjs} +444 -590
- package/dist/.setup/{policy-yhn48xf5.mjs → policy-C6_DdlSf.mjs} +3 -6
- package/dist/.setup/{session-status-Dv8wNBEt.mjs → probe-B_Ax1vS1.mjs} +1015 -678
- package/dist/.setup/question-delivery-D3qAIwuv.mjs +38 -0
- package/dist/.setup/{relay-source-oY9SbDiX.mjs → relay-source-a8jodKuO.mjs} +12 -6
- package/dist/.setup/{replies-CJwjTqDr.mjs → replies-Bq7n0gfM.mjs} +37 -24
- package/dist/.setup/{reply-blocks-Ca-raz2z.mjs → reply-blocks-DyYYRrP_.mjs} +202 -210
- package/dist/.setup/{resolve-channels-DRRhElwz.mjs → resolve-channels-CF2JME9q.mjs} +6 -10
- package/dist/.setup/{resolve-users-Cz8e17ky.mjs → resolve-users-DDcCAjH1.mjs} +10 -19
- package/dist/.setup/{rolldown-runtime-B4FMCO8f.mjs → rolldown-runtime-nwUcYXjP.mjs} +1 -2
- package/dist/.setup/{runtime-JSVZSWAj.mjs → runtime-C6HKn7Av.mjs} +1 -2
- package/dist/.setup/runtime-setter-api-DrXr965r.mjs +2 -0
- package/dist/.setup/{scopes-DfQVi8Jw.mjs → scopes-CzHC_dwV.mjs} +3 -3
- package/dist/.setup/{secret-contract-B-Qm6aQQ.mjs → secret-contract-CqVqR7MP.mjs} +5 -4
- package/dist/.setup/{secret-contract-api-DB6CMdgc.mjs → secret-contract-api-DaCXZ47j.mjs} +1 -1
- package/dist/.setup/{security-audit-DFGiFLqd.mjs → security-audit-C3hXCfDt.mjs} +2 -3
- package/dist/.setup/{send-C-8wY0lK.mjs → send-WJZ73VSf.mjs} +306 -349
- package/dist/.setup/{send-results-eeOu_HYm.mjs → send-results-Bm6V1ekL.mjs} +4 -6
- package/dist/.setup/setup-plugin-api-DJXIB8CF.mjs +2 -0
- package/dist/.setup/{setup-surface-9WVQgYCT.mjs → setup-surface-uIqP2B0Y.mjs} +6 -8
- package/dist/.setup/{slash-dispatch.runtime-v5kQqJPh.mjs → slash-dispatch.runtime-Cwuwv7FL.mjs} +2 -2
- package/dist/.setup/{target-parsing-FFE26kOV.mjs → target-parsing-DwYAP3ts.mjs} +2 -4
- package/dist/.setup/{targets-C6LZQL1Q.mjs → targets-eeOxA_b_.mjs} +2 -3
- package/dist/.setup/{thread-ts-Cvt7WD6B.mjs → thread-ts-47Au2-Yn.mjs} +1 -2
- package/dist/.source-module-urls/c5ffd0957b234c7c12090e7de4eca2482ef339b8561e078da55b734211b0ba58.json +1 -0
- package/dist/account-inspect-api.js +2 -3
- package/dist/api.js +17 -18
- package/dist/channel-config-api.js +1 -1
- package/dist/channel-entry.js +1 -2
- package/dist/channel-plugin-api.js +1 -1
- package/dist/configured-state.js +2 -3
- package/dist/directory-contract-api.js +1 -1
- package/dist/doctor-contract-api.js +1 -1
- package/dist/index.js +1 -8
- package/dist/message-tool-api.js +1 -1
- package/dist/runtime-api.js +11 -13
- package/dist/runtime-setter-api.js +1 -1
- package/dist/secret-contract-api.js +1 -1
- package/dist/security-contract-api.js +1 -1
- package/dist/setup-entry.js +4 -5
- package/dist/setup-plugin-api.js +1 -1
- package/node_modules/@slack/bolt/node_modules/@types/node/README.md +1 -1
- package/node_modules/@slack/bolt/node_modules/@types/node/package.json +2 -2
- package/node_modules/@slack/bolt/node_modules/@types/node/util.d.ts +6 -3
- package/node_modules/@slack/bolt/node_modules/content-disposition/README.md +105 -35
- package/node_modules/@slack/bolt/node_modules/content-disposition/dist/index.d.ts +72 -0
- package/node_modules/@slack/bolt/node_modules/content-disposition/dist/index.js +388 -0
- package/node_modules/@slack/bolt/node_modules/content-disposition/dist/index.js.map +1 -0
- package/node_modules/@slack/bolt/node_modules/content-disposition/package.json +31 -19
- package/node_modules/@slack/bolt/node_modules/content-type/README.md +34 -57
- package/node_modules/@slack/bolt/node_modules/content-type/package.json +35 -25
- package/node_modules/@slack/bolt/node_modules/express/Readme.md +15 -9
- package/node_modules/@slack/bolt/node_modules/express/lib/application.js +2 -2
- package/node_modules/@slack/bolt/node_modules/express/lib/request.js +32 -19
- package/node_modules/@slack/bolt/node_modules/express/lib/response.js +27 -30
- package/node_modules/@slack/bolt/node_modules/express/package.json +10 -10
- package/node_modules/@slack/bolt/node_modules/qs/.github/THREAT_MODEL.md +4 -2
- package/node_modules/@slack/bolt/node_modules/qs/CHANGELOG.md +38 -14
- package/node_modules/@slack/bolt/node_modules/qs/README.md +31 -3
- package/node_modules/@slack/bolt/node_modules/qs/dist/qs.js +20 -20
- package/node_modules/@slack/bolt/node_modules/qs/lib/parse.js +94 -4
- package/node_modules/@slack/bolt/node_modules/qs/lib/stringify.js +4 -4
- package/node_modules/@slack/bolt/node_modules/qs/lib/utils.js +130 -6
- package/node_modules/@slack/bolt/node_modules/qs/package.json +4 -4
- package/node_modules/@slack/bolt/node_modules/qs/test/parse.js +174 -0
- package/node_modules/@slack/bolt/node_modules/qs/test/stringify.js +263 -33
- package/node_modules/@slack/bolt/node_modules/qs/test/utils.js +184 -0
- package/node_modules/@slack/web-api/node_modules/@types/node/README.md +1 -1
- package/node_modules/@slack/web-api/node_modules/@types/node/package.json +2 -2
- package/node_modules/@slack/web-api/node_modules/@types/node/util.d.ts +6 -3
- package/node_modules/typebox/build/format/duration.d.mts +2 -2
- package/node_modules/typebox/build/format/duration.mjs +2 -2
- package/node_modules/typebox/build/format/idn_email.d.mts +1 -0
- package/node_modules/typebox/build/format/idn_email.mjs +1 -0
- package/node_modules/typebox/build/format/idn_hostname.d.mts +1 -1
- package/node_modules/typebox/build/format/idn_hostname.mjs +1 -1
- package/node_modules/typebox/build/format/ipv4.d.mts +2 -2
- package/node_modules/typebox/build/format/ipv4.mjs +2 -2
- package/node_modules/typebox/build/format/ipv6.d.mts +1 -1
- package/node_modules/typebox/build/format/ipv6.mjs +1 -1
- package/node_modules/typebox/build/format/relative_json_pointer.d.mts +2 -2
- package/node_modules/typebox/build/format/relative_json_pointer.mjs +2 -2
- package/node_modules/typebox/build/schema/build.mjs +1 -0
- package/node_modules/typebox/build/schema/engine/_unique.d.mts +4 -2
- package/node_modules/typebox/build/schema/engine/_unique.mjs +7 -3
- package/node_modules/typebox/build/schema/engine/additionalItems.mjs +3 -3
- package/node_modules/typebox/build/schema/engine/additionalProperties.d.mts +0 -3
- package/node_modules/typebox/build/schema/engine/additionalProperties.mjs +15 -17
- package/node_modules/typebox/build/schema/engine/contains.mjs +3 -3
- package/node_modules/typebox/build/schema/engine/index.d.mts +1 -0
- package/node_modules/typebox/build/schema/engine/index.mjs +1 -0
- package/node_modules/typebox/build/schema/engine/items.mjs +7 -4
- package/node_modules/typebox/build/schema/engine/maxContains.mjs +2 -2
- package/node_modules/typebox/build/schema/engine/minContains.mjs +3 -3
- package/node_modules/typebox/build/schema/engine/oneOf.mjs +2 -2
- package/node_modules/typebox/build/schema/engine/patternProperties.mjs +2 -2
- package/node_modules/typebox/build/schema/engine/propertyNames.mjs +2 -2
- package/node_modules/typebox/build/schema/engine/unevaluatedItems.mjs +2 -2
- package/node_modules/typebox/build/schema/engine/unevaluatedProperties.mjs +2 -2
- package/node_modules/typebox/build/system/hashing/hash.mjs +63 -34
- package/node_modules/typebox/build/system/locale/en_US.mjs +2 -1
- package/node_modules/typebox/build/system/memory/assign.d.mts +2 -8
- package/node_modules/typebox/build/system/memory/assign.mjs +13 -6
- package/node_modules/typebox/build/system/memory/clone.d.mts +4 -5
- package/node_modules/typebox/build/system/memory/clone.mjs +8 -96
- package/node_modules/typebox/build/system/memory/create.d.mts +1 -5
- package/node_modules/typebox/build/system/memory/create.mjs +18 -13
- package/node_modules/typebox/build/system/memory/deep.d.mts +2 -0
- package/node_modules/typebox/build/system/memory/deep.mjs +108 -0
- package/node_modules/typebox/build/system/memory/discard.d.mts +1 -1
- package/node_modules/typebox/build/system/memory/discard.mjs +9 -8
- package/node_modules/typebox/build/system/memory/finalize.d.mts +4 -0
- package/node_modules/typebox/build/system/memory/finalize.mjs +30 -0
- package/node_modules/typebox/build/system/memory/keys.d.mts +2 -0
- package/node_modules/typebox/build/system/memory/keys.mjs +8 -0
- package/node_modules/typebox/build/system/memory/update.d.mts +1 -4
- package/node_modules/typebox/build/system/memory/update.mjs +43 -16
- package/node_modules/typebox/build/type/engine/call/index.d.mts +1 -0
- package/node_modules/typebox/build/type/engine/call/index.mjs +1 -0
- package/node_modules/typebox/build/type/engine/evaluate/composite.d.mts +2 -24
- package/node_modules/typebox/build/type/engine/evaluate/composite.mjs +2 -29
- package/node_modules/typebox/build/type/engine/evaluate/index.d.mts +1 -0
- package/node_modules/typebox/build/type/engine/evaluate/index.mjs +1 -0
- package/node_modules/typebox/build/type/engine/evaluate/narrow.d.mts +5 -1
- package/node_modules/typebox/build/type/engine/evaluate/narrow.mjs +6 -1
- package/node_modules/typebox/build/type/engine/evaluate/property.d.mts +30 -0
- package/node_modules/typebox/build/type/engine/evaluate/property.mjs +29 -0
- package/node_modules/typebox/build/type/engine/immutable/instantiate_add.d.mts +1 -3
- package/node_modules/typebox/build/type/engine/immutable/instantiate_add.mjs +1 -4
- package/node_modules/typebox/build/type/engine/object/from_intersect.d.mts +2 -2
- package/node_modules/typebox/build/type/engine/object/from_intersect.mjs +2 -2
- package/node_modules/typebox/build/type/engine/object/from_union.d.mts +2 -2
- package/node_modules/typebox/build/type/engine/object/from_union.mjs +2 -2
- package/node_modules/typebox/build/type/engine/optional/instantiate_add.d.mts +1 -3
- package/node_modules/typebox/build/type/engine/optional/instantiate_add.mjs +1 -4
- package/node_modules/typebox/build/type/engine/readonly/instantiate_add.d.mts +1 -3
- package/node_modules/typebox/build/type/engine/readonly/instantiate_add.mjs +1 -4
- package/node_modules/typebox/build/type/engine/this/index.d.mts +1 -0
- package/node_modules/typebox/build/type/engine/this/index.mjs +1 -0
- package/node_modules/typebox/build/value/clone/clone.d.mts +4 -3
- package/node_modules/typebox/build/value/clone/clone.mjs +5 -7
- package/node_modules/typebox/build/value/repair/from_cyclic.d.mts +2 -0
- package/node_modules/typebox/build/value/repair/from_cyclic.mjs +6 -0
- package/node_modules/typebox/build/value/shared/union_priority_sort.mjs +25 -14
- package/node_modules/typebox/package.json +1 -1
- package/node_modules/typebox/readme.md +1 -1
- package/node_modules/undici/README.md +25 -3
- package/node_modules/undici/docs/docs/api/CacheStore.md +24 -9
- package/node_modules/undici/docs/docs/api/Client.md +11 -6
- package/node_modules/undici/docs/docs/api/Dispatcher.md +3 -0
- package/node_modules/undici/docs/docs/api/Errors.md +76 -1
- package/node_modules/undici/docs/docs/api/H2CClient.md +3 -2
- package/node_modules/undici/docs/docs/api/Interceptors.md +28 -8
- package/node_modules/undici/docs/docs/api/RedirectHandler.md +13 -10
- package/node_modules/undici/docs/docs/index.md +12 -12
- package/node_modules/undici/docs/docs/type-map.json +66 -66
- package/node_modules/undici/lib/cache/memory-cache-store.js +48 -13
- package/node_modules/undici/lib/cache/sqlite-cache-store.js +83 -5
- package/node_modules/undici/lib/core/connect.js +10 -4
- package/node_modules/undici/lib/core/constants.js +12 -1
- package/node_modules/undici/lib/core/errors.js +38 -1
- package/node_modules/undici/lib/core/request.js +16 -1
- package/node_modules/undici/lib/core/symbols.js +2 -0
- package/node_modules/undici/lib/core/util.js +26 -1
- package/node_modules/undici/lib/dispatcher/agent.js +6 -2
- package/node_modules/undici/lib/dispatcher/client-h1.js +116 -80
- package/node_modules/undici/lib/dispatcher/client-h2.js +124 -17
- package/node_modules/undici/lib/dispatcher/client.js +4 -1
- package/node_modules/undici/lib/dispatcher/dispatcher-base.js +3 -2
- package/node_modules/undici/lib/dispatcher/dispatcher1-wrapper.js +20 -3
- package/node_modules/undici/lib/dispatcher/parser-h1.js +1064 -0
- package/node_modules/undici/lib/dispatcher/pool-base.js +85 -31
- package/node_modules/undici/lib/dispatcher/pool.js +11 -8
- package/node_modules/undici/lib/dispatcher/proxy-agent.js +18 -8
- package/node_modules/undici/lib/dispatcher/retry-agent.js +10 -0
- package/node_modules/undici/lib/dispatcher/round-robin-pool.js +15 -5
- package/node_modules/undici/lib/handler/cache-handler.js +153 -15
- package/node_modules/undici/lib/handler/deduplication-handler.js +112 -51
- package/node_modules/undici/lib/handler/redirect-handler.js +28 -8
- package/node_modules/undici/lib/handler/retry-handler.js +44 -11
- package/node_modules/undici/lib/interceptor/cache.js +11 -3
- package/node_modules/undici/lib/interceptor/decompress.js +22 -9
- package/node_modules/undici/lib/interceptor/dns.js +11 -0
- package/node_modules/undici/lib/interceptor/response-error.js +72 -28
- package/node_modules/undici/lib/milo/LICENSE.md +7 -0
- package/node_modules/undici/lib/milo/no-simd.js +1002 -0
- package/node_modules/undici/lib/milo/simd.js +1002 -0
- package/node_modules/undici/lib/mock/mock-agent.js +11 -0
- package/node_modules/undici/lib/mock/snapshot-recorder.js +3 -2
- package/node_modules/undici/lib/mock/snapshot-utils.js +3 -2
- package/node_modules/undici/lib/util/cache.js +11 -5
- package/node_modules/undici/lib/web/cookies/util.js +19 -2
- package/node_modules/undici/lib/web/eventsource/eventsource-stream.js +69 -15
- package/node_modules/undici/lib/web/eventsource/eventsource.js +25 -2
- package/node_modules/undici/lib/web/fetch/body.js +47 -38
- package/node_modules/undici/lib/web/fetch/formdata-parser.js +12 -4
- package/node_modules/undici/lib/web/fetch/headers.js +2 -2
- package/node_modules/undici/lib/web/fetch/index.js +8 -4
- package/node_modules/undici/lib/web/subresource-integrity/subresource-integrity.js +5 -5
- package/node_modules/undici/lib/web/websocket/receiver.js +25 -4
- package/node_modules/undici/package.json +9 -7
- package/node_modules/undici/types/api.d.ts +1 -1
- package/node_modules/undici/types/cache-interceptor.d.ts +10 -0
- package/node_modules/undici/types/client.d.ts +10 -4
- package/node_modules/undici/types/errors.d.ts +16 -1
- package/node_modules/undici/types/h2c-client.d.ts +1 -1
- package/node_modules/undici/types/interceptors.d.ts +6 -1
- package/node_modules/undici/types/utility.d.ts +4 -4
- package/node_modules/zod/package.json +1 -1
- package/node_modules/zod/src/v4/classic/tests/array.test.ts +27 -0
- package/node_modules/zod/src/v4/classic/tests/map.test.ts +7 -0
- package/node_modules/zod/src/v4/classic/tests/set.test.ts +6 -0
- package/node_modules/zod/src/v4/core/compile.ts +9 -0
- package/node_modules/zod/src/v4/core/schemas.ts +35 -1
- package/node_modules/zod/src/v4/core/util.ts +13 -0
- package/node_modules/zod/src/v4/core/versions.ts +1 -1
- package/node_modules/zod/v4/core/compile.cjs +8 -0
- package/node_modules/zod/v4/core/compile.js +8 -0
- package/node_modules/zod/v4/core/schemas.cjs +30 -0
- package/node_modules/zod/v4/core/schemas.d.cts +3 -1
- package/node_modules/zod/v4/core/schemas.d.ts +3 -1
- package/node_modules/zod/v4/core/schemas.js +30 -0
- package/node_modules/zod/v4/core/util.cjs +15 -0
- package/node_modules/zod/v4/core/util.d.cts +2 -0
- package/node_modules/zod/v4/core/util.d.ts +2 -0
- package/node_modules/zod/v4/core/util.js +14 -0
- package/node_modules/zod/v4/core/versions.cjs +1 -1
- package/node_modules/zod/v4/core/versions.js +1 -1
- package/openclaw.plugin.json +6 -30
- package/package.json +7 -7
- package/dist/.setup/action-runtime.runtime-Ck_j1YTn.mjs +0 -1
- package/dist/.setup/http-C9sM-FXe.mjs +0 -2
- package/dist/.setup/plugin-routes-D4qozHVn.mjs +0 -22
- package/dist/.setup/probe-IiHogLQN.mjs +0 -694
- package/dist/.setup/registry-DizWcnNp.mjs +0 -36
- package/dist/.setup/runtime-setter-api-Cx_PV-xu.mjs +0 -2
- package/dist/.setup/setup-plugin-api-B18kDKtr.mjs +0 -2
- package/dist/.setup/shared-DpHCoKy2.mjs +0 -259
- package/dist/.source-module-urls/562d694877afe9d9dcbb3b32a8883c16974738f2aa892c48d45572cdc9a62529.json +0 -1
- package/dist/http-routes-api.js +0 -1
- package/node_modules/@slack/bolt/node_modules/body-parser/node_modules/content-type/LICENSE +0 -22
- package/node_modules/@slack/bolt/node_modules/body-parser/node_modules/content-type/README.md +0 -71
- package/node_modules/@slack/bolt/node_modules/body-parser/node_modules/content-type/package.json +0 -52
- package/node_modules/@slack/bolt/node_modules/content-disposition/index.js +0 -536
- package/node_modules/@slack/bolt/node_modules/content-type/HISTORY.md +0 -29
- package/node_modules/@slack/bolt/node_modules/content-type/index.js +0 -225
- package/node_modules/@slack/bolt/node_modules/negotiator/node_modules/content-type/LICENSE +0 -22
- package/node_modules/@slack/bolt/node_modules/negotiator/node_modules/content-type/README.md +0 -71
- package/node_modules/@slack/bolt/node_modules/negotiator/node_modules/content-type/dist/index.d.ts +0 -46
- package/node_modules/@slack/bolt/node_modules/negotiator/node_modules/content-type/dist/index.js +0 -176
- package/node_modules/@slack/bolt/node_modules/negotiator/node_modules/content-type/dist/index.js.map +0 -1
- package/node_modules/@slack/bolt/node_modules/negotiator/node_modules/content-type/package.json +0 -52
- package/node_modules/@slack/bolt/node_modules/type-is/node_modules/content-type/LICENSE +0 -22
- package/node_modules/@slack/bolt/node_modules/type-is/node_modules/content-type/README.md +0 -71
- package/node_modules/@slack/bolt/node_modules/type-is/node_modules/content-type/dist/index.d.ts +0 -46
- package/node_modules/@slack/bolt/node_modules/type-is/node_modules/content-type/dist/index.js +0 -176
- package/node_modules/@slack/bolt/node_modules/type-is/node_modules/content-type/dist/index.js.map +0 -1
- package/node_modules/@slack/bolt/node_modules/type-is/node_modules/content-type/package.json +0 -52
- package/node_modules/typebox/build/system/memory/freeze.d.mts +0 -4
- package/node_modules/typebox/build/system/memory/freeze.mjs +0 -6
- /package/node_modules/@slack/bolt/node_modules/{body-parser/node_modules/content-type → content-type}/dist/index.d.ts +0 -0
- /package/node_modules/@slack/bolt/node_modules/{body-parser/node_modules/content-type → content-type}/dist/index.js +0 -0
- /package/node_modules/@slack/bolt/node_modules/{body-parser/node_modules/content-type → content-type}/dist/index.js.map +0 -0
|
@@ -31,6 +31,7 @@ var cookie = require('cookie');
|
|
|
31
31
|
var send = require('send');
|
|
32
32
|
var extname = path.extname;
|
|
33
33
|
var resolve = path.resolve;
|
|
34
|
+
var basename = path.basename;
|
|
34
35
|
var vary = require('vary');
|
|
35
36
|
const { Buffer } = require('node:buffer');
|
|
36
37
|
|
|
@@ -126,7 +127,6 @@ res.send = function send(body) {
|
|
|
126
127
|
var chunk = body;
|
|
127
128
|
var encoding;
|
|
128
129
|
var req = this.req;
|
|
129
|
-
var type;
|
|
130
130
|
|
|
131
131
|
// settings
|
|
132
132
|
var app = this.app;
|
|
@@ -134,7 +134,12 @@ res.send = function send(body) {
|
|
|
134
134
|
switch (typeof chunk) {
|
|
135
135
|
// string defaulting to html
|
|
136
136
|
case 'string':
|
|
137
|
-
|
|
137
|
+
encoding = 'utf8';
|
|
138
|
+
const type = this.get('Content-Type');
|
|
139
|
+
|
|
140
|
+
if (typeof type === 'string') {
|
|
141
|
+
this.set('Content-Type', setCharset(type, 'utf-8'));
|
|
142
|
+
} else {
|
|
138
143
|
this.type('html');
|
|
139
144
|
}
|
|
140
145
|
break;
|
|
@@ -153,23 +158,11 @@ res.send = function send(body) {
|
|
|
153
158
|
break;
|
|
154
159
|
}
|
|
155
160
|
|
|
156
|
-
// write strings in utf-8
|
|
157
|
-
if (typeof chunk === 'string') {
|
|
158
|
-
encoding = 'utf8';
|
|
159
|
-
type = this.get('Content-Type');
|
|
160
|
-
|
|
161
|
-
// reflect this in content-type
|
|
162
|
-
if (typeof type === 'string') {
|
|
163
|
-
this.set('Content-Type', setCharset(type, 'utf-8'));
|
|
164
|
-
}
|
|
165
|
-
}
|
|
166
|
-
|
|
167
161
|
// determine if ETag should be generated
|
|
168
162
|
var etagFn = app.get('etag fn')
|
|
169
163
|
var generateETag = !this.get('ETag') && typeof etagFn === 'function'
|
|
170
164
|
|
|
171
|
-
|
|
172
|
-
var len
|
|
165
|
+
var len;
|
|
173
166
|
if (chunk !== undefined) {
|
|
174
167
|
if (Buffer.isBuffer(chunk)) {
|
|
175
168
|
// get length of Buffer
|
|
@@ -184,7 +177,11 @@ res.send = function send(body) {
|
|
|
184
177
|
len = chunk.length
|
|
185
178
|
}
|
|
186
179
|
|
|
187
|
-
|
|
180
|
+
// Because Content-Length and Transfer-Encoding can't be present in the response headers together,
|
|
181
|
+
// Content-Length should be added only if there is no Transfer-Encoding header
|
|
182
|
+
if (!this.get('Transfer-Encoding')) {
|
|
183
|
+
this.set('Content-Length', len);
|
|
184
|
+
}
|
|
188
185
|
}
|
|
189
186
|
|
|
190
187
|
// populate ETag
|
|
@@ -367,7 +364,7 @@ res.sendStatus = function sendStatus(statusCode) {
|
|
|
367
364
|
* if (yes) {
|
|
368
365
|
* res.sendFile('/uploads/' + uid + '/' + file);
|
|
369
366
|
* } else {
|
|
370
|
-
* res.send(403, 'Sorry! you
|
|
367
|
+
* res.send(403, 'Sorry! you can\'t see that.');
|
|
371
368
|
* }
|
|
372
369
|
* });
|
|
373
370
|
* });
|
|
@@ -452,7 +449,7 @@ res.download = function download (path, filename, options, callback) {
|
|
|
452
449
|
opts = null
|
|
453
450
|
}
|
|
454
451
|
|
|
455
|
-
// support optional filename, where options may be in
|
|
452
|
+
// support optional filename, where options may be in its place
|
|
456
453
|
if (typeof filename === 'object' &&
|
|
457
454
|
(typeof options === 'function' || options === undefined)) {
|
|
458
455
|
name = null
|
|
@@ -461,7 +458,7 @@ res.download = function download (path, filename, options, callback) {
|
|
|
461
458
|
|
|
462
459
|
// set Content-Disposition when file is sent
|
|
463
460
|
var headers = {
|
|
464
|
-
'Content-Disposition': contentDisposition(name || path)
|
|
461
|
+
'Content-Disposition': contentDisposition.create(basename(name || path))
|
|
465
462
|
};
|
|
466
463
|
|
|
467
464
|
// merge user-provided headers
|
|
@@ -491,7 +488,7 @@ res.download = function download (path, filename, options, callback) {
|
|
|
491
488
|
/**
|
|
492
489
|
* Set _Content-Type_ response header with `type` through `mime.contentType()`
|
|
493
490
|
* when it does not contain "/", or set the Content-Type to `type` otherwise.
|
|
494
|
-
* When no mapping is found
|
|
491
|
+
* When no mapping is found through `mime.contentType()`, the type is set to
|
|
495
492
|
* "application/octet-stream".
|
|
496
493
|
*
|
|
497
494
|
* Examples:
|
|
@@ -520,8 +517,9 @@ res.type = function contentType(type) {
|
|
|
520
517
|
* Respond to the Acceptable formats using an `obj`
|
|
521
518
|
* of mime-type callbacks.
|
|
522
519
|
*
|
|
523
|
-
* This method uses `req.
|
|
524
|
-
* acceptable types ordered by
|
|
520
|
+
* This method uses `req.accepts()`, which returns the
|
|
521
|
+
* best match from the acceptable types ordered by
|
|
522
|
+
* their quality values.
|
|
525
523
|
* When "Accept" is not present the _first_ callback
|
|
526
524
|
* is invoked, otherwise the first match is used. When
|
|
527
525
|
* no match is performed the server responds with
|
|
@@ -609,11 +607,12 @@ res.format = function(obj){
|
|
|
609
607
|
*/
|
|
610
608
|
|
|
611
609
|
res.attachment = function attachment(filename) {
|
|
612
|
-
|
|
613
|
-
|
|
610
|
+
const name = filename !== undefined ? basename(filename) : undefined;
|
|
611
|
+
if (name) {
|
|
612
|
+
this.type(extname(name));
|
|
614
613
|
}
|
|
615
614
|
|
|
616
|
-
this.set('Content-Disposition', contentDisposition(
|
|
615
|
+
this.set('Content-Disposition', contentDisposition.create(name));
|
|
617
616
|
|
|
618
617
|
return this;
|
|
619
618
|
};
|
|
@@ -784,12 +783,9 @@ res.cookie = function (name, value, options) {
|
|
|
784
783
|
/**
|
|
785
784
|
* Set the location header to `url`.
|
|
786
785
|
*
|
|
787
|
-
* The given `url` can also be "back", which redirects
|
|
788
|
-
* to the _Referrer_ or _Referer_ headers or "/".
|
|
789
|
-
*
|
|
790
786
|
* Examples:
|
|
791
787
|
*
|
|
792
|
-
* res.location('/foo/bar')
|
|
788
|
+
* res.location('/foo/bar');
|
|
793
789
|
* res.location('http://example.com');
|
|
794
790
|
* res.location('../login');
|
|
795
791
|
*
|
|
@@ -850,7 +846,8 @@ res.redirect = function redirect(url) {
|
|
|
850
846
|
|
|
851
847
|
html: function(){
|
|
852
848
|
var u = escapeHtml(address);
|
|
853
|
-
body = '
|
|
849
|
+
body = '<!DOCTYPE html><head><title>' + statuses.message[status] + '</title></head>'
|
|
850
|
+
+ '<body><p>' + statuses.message[status] + '. Redirecting to ' + u + '</p></body>'
|
|
854
851
|
},
|
|
855
852
|
|
|
856
853
|
default: function(){
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "express",
|
|
3
3
|
"description": "Fast, unopinionated, minimalist web framework",
|
|
4
|
-
"version": "5.
|
|
4
|
+
"version": "5.3.0",
|
|
5
5
|
"author": "TJ Holowaychuk <tj@vision-media.ca>",
|
|
6
6
|
"contributors": [
|
|
7
7
|
"Aaron Heckmann <aaron.heckmann+github@gmail.com>",
|
|
@@ -33,9 +33,9 @@
|
|
|
33
33
|
],
|
|
34
34
|
"dependencies": {
|
|
35
35
|
"accepts": "^2.0.0",
|
|
36
|
-
"body-parser": "^2.
|
|
37
|
-
"content-disposition": "^
|
|
38
|
-
"content-type": "^
|
|
36
|
+
"body-parser": "^2.3.0",
|
|
37
|
+
"content-disposition": "^2.0.1",
|
|
38
|
+
"content-type": "^2.0.0",
|
|
39
39
|
"cookie": "^0.7.1",
|
|
40
40
|
"cookie-signature": "^1.2.1",
|
|
41
41
|
"debug": "^4.4.0",
|
|
@@ -51,14 +51,14 @@
|
|
|
51
51
|
"on-finished": "^2.4.1",
|
|
52
52
|
"once": "^1.4.0",
|
|
53
53
|
"parseurl": "^1.3.3",
|
|
54
|
-
"proxy-addr": "^2.0.
|
|
55
|
-
"qs": "^6.
|
|
54
|
+
"proxy-addr": "^2.0.8",
|
|
55
|
+
"qs": "^6.16.0",
|
|
56
56
|
"range-parser": "^1.2.1",
|
|
57
57
|
"router": "^2.2.0",
|
|
58
58
|
"send": "^1.1.0",
|
|
59
59
|
"serve-static": "^2.2.0",
|
|
60
60
|
"statuses": "^2.0.1",
|
|
61
|
-
"type-is": "^2.0
|
|
61
|
+
"type-is": "^2.1.0",
|
|
62
62
|
"vary": "^1.1.2"
|
|
63
63
|
},
|
|
64
64
|
"devDependencies": {
|
|
@@ -69,11 +69,11 @@
|
|
|
69
69
|
"ejs": "^3.1.10",
|
|
70
70
|
"eslint": "8.47.0",
|
|
71
71
|
"express-session": "^1.18.1",
|
|
72
|
-
"hbs": "4.
|
|
72
|
+
"hbs": "4.3.1",
|
|
73
73
|
"marked": "^15.0.3",
|
|
74
74
|
"method-override": "3.0.0",
|
|
75
|
-
"mocha": "^
|
|
76
|
-
"morgan": "1.
|
|
75
|
+
"mocha": "^11.7.5",
|
|
76
|
+
"morgan": "1.12.1",
|
|
77
77
|
"nyc": "^17.1.0",
|
|
78
78
|
"pbkdf2-password": "1.2.1",
|
|
79
79
|
"supertest": "^6.3.0",
|
|
@@ -24,7 +24,7 @@ Caller Application → qs.stringify(obj, options) → Stringifying Engine → Ou
|
|
|
24
24
|
```
|
|
25
25
|
|
|
26
26
|
**Trust Boundaries:**
|
|
27
|
-
- **Input string (parse):** May come from untrusted sources (e.g., user input, network requests)
|
|
27
|
+
- **Input string (parse):** May come from untrusted sources (e.g., user input, network requests). `qs` defines its own key grammar, where bracket groups denote nesting, so the parameter names it derives are deliberately not the flat names produced by `URLSearchParams`, `node:querystring`, or a WHATWG-conformant parser. The parsed object, not the raw string, is the only thing a caller should make trust decisions about; see "Interpretation conflict" below.
|
|
28
28
|
- **Input object (stringify):** The calling application's own data, not a direct untrusted channel. May contain cycles (handled by the cycle detector). Deeply-nested non-cyclic input surfaces as a catchable synchronous `RangeError` (stack overflow), not unbounded resource consumption; callers that serialize externally-influenced objects should bound their depth/size beforehand.
|
|
29
29
|
- **Options:** Provided by the caller
|
|
30
30
|
- **Cycle Tracking:** Used only during stringification to detect and handle circular references
|
|
@@ -51,6 +51,7 @@ Caller Application → qs.stringify(obj, options) → Stringifying Engine → Ou
|
|
|
51
51
|
- **Information Disclosure:** Error messages may expose internal details or sensitive data.
|
|
52
52
|
- **Denial of Service:** Large or malformed input can exhaust memory or CPU.
|
|
53
53
|
- **Elevation of Privilege:** Prototype pollution can lead to unintended privilege escalation in the host application[3][4][8].
|
|
54
|
+
- **Interpretation conflict (out of scope):** An application that parses the same query string with two different parsers, and makes a trust decision on one result while consuming the other, can be attacked by any input the two parsers read differently. `qs`'s bracket grammar guarantees such inputs exist, so this is a property of the deployment, not a defect `qs` can remove. It is the calling application's responsibility to parse once and validate the parsed object.
|
|
54
55
|
|
|
55
56
|
### 6. Mitigation/Countermeasures
|
|
56
57
|
|
|
@@ -58,8 +59,9 @@ Caller Application → qs.stringify(obj, options) → Stringifying Engine → Ou
|
|
|
58
59
|
|---------------------------------------------------|---------------------|
|
|
59
60
|
| Tampering (malicious input, prototype pollution) | Strict input validation; keep `allowPrototypes: false` by default; use `plainObjects` for output; ensure builtins/globals are never modified by parse[4][8]. |
|
|
60
61
|
| Information Disclosure (error messages) | Generic error messages without stack traces or internal paths. |
|
|
61
|
-
| Denial of Service (memory/CPU exhaustion) | `arrayLimit`, `parameterLimit`, and depth limiting apply with safe defaults. Note that `arrayLimit` is a representation threshold (array vs. object), and `parameterLimit` bounds only the number of `&`-delimited parameters - neither caps the elements produced by `comma: true` splitting. For
|
|
62
|
+
| Denial of Service (memory/CPU exhaustion) | `arrayLimit`, `parameterLimit`, and depth limiting apply with safe defaults. Note that `arrayLimit` is a representation threshold (array vs. object), and `parameterLimit` bounds only the number of `&`-delimited parameters - neither caps the elements produced by `comma: true` splitting. For hard caps on the number of parameters and on each array's length, opt in to `throwOnLimitExceeded: true` (default `false`), which rejects a query string with more than `parameterLimit` parameters, or one that would produce any array longer than `arrayLimit`. `arrayLimit` applies to each array separately, including each parameter's comma-split value, so the total number of values can still reach `parameterLimit` times `arrayLimit`; always bound input size at the transport layer as well[7]. On the `stringify` side, the input is the caller's own object rather than an untrusted string, so unbounded nesting manifests as a catchable `RangeError` (stack overflow) rather than exhaustion; callers serializing externally-influenced objects should bound depth/size beforehand, and may opt into `stringify`'s `depth` option (default `Infinity`) for a deterministic, catchable error. |
|
|
62
63
|
| Elevation of Privilege (prototype pollution) | Keep `allowPrototypes: false`; validate options against allowlist; use `plainObjects` to avoid prototype pollution[4][8]. |
|
|
64
|
+
| Interpretation conflict (validate-then-use across two parsers) | None available inside `qs`, by construction: `qs` and a flat parser disagree about parameter names for well-formed input, so no hardening can make the two views equal. Parse untrusted input once, with `qs`, and apply deny lists, authorization, and signature checks to the parsed object rather than to raw key text. Text that `qs` cannot place in its grammar is currently dropped, so distinct raw names can share one parsed path ([#619](https://github.com/ljharb/qs/issues/619)). |
|
|
63
65
|
|
|
64
66
|
### 7. Risk Ranking
|
|
65
67
|
|
|
@@ -1,17 +1,41 @@
|
|
|
1
|
+
## **6.16.1**
|
|
2
|
+
- [Fix] `parse`: do not mutate an object input
|
|
3
|
+
- [Fix] `stringify`: stop re-encoding structural separator dots when `encodeDotInKeys` is set (#564)
|
|
4
|
+
- [Fix] `stringify`: `arrayFormat: 'comma'`: pass the full encoder arguments with `encodeValuesOnly`
|
|
5
|
+
- [Fix] `utils`: encode `+` as `%2B` in iso-8859-1 mode so values round-trip (#565)
|
|
6
|
+
- [Fix] parse: only convert top-level dots to brackets when allowDots is on (#621)
|
|
7
|
+
- [Fix] `stringify`: ignore inherited array format names (#622)
|
|
8
|
+
- [Fix] `stringify`: `arrayFormat: 'comma'`: do not throw on elements with no callable `toString`
|
|
9
|
+
- [Fix] `utils`: `merge`: seed an overflow container's index from its own keys, not just the source
|
|
10
|
+
- [Fix] `utils`: `merge`: keep a `strictMerge` conflict container's index and `arrayLimit` correct
|
|
11
|
+
- [Fix] `parse`: only treat `[]` as array syntax when it ends the key
|
|
12
|
+
- [Perf] `decode`: skip decoders when there is no percent sign (#583)
|
|
13
|
+
- [Robustness] `utils`: `merge`: apply `arrayLimit` to the two-element array built for colliding values
|
|
14
|
+
- [Robustness] `parse`: bound the nesting added by repeated `strictMerge` conflicts
|
|
15
|
+
- [Docs] document that `qs` and flat parsers disagree about parameter names
|
|
16
|
+
- [Docs] clarify that `throwOnLimitExceeded` limits each array, not the total number of values
|
|
17
|
+
- [Docs] clarify 6.14.1/6.15.2 parse bracket behavior change (#567, #568)
|
|
18
|
+
- [meta] fix changelog indents
|
|
19
|
+
- [actions] set least-privilege `cache-mode`
|
|
20
|
+
- [Tests] `utils`: `decode`: add missing cases
|
|
21
|
+
- [Tests] `parse`: characterize the `]=` split when an `=` precedes any bracket group (#620)
|
|
22
|
+
- [Tests] `parse`: `allowDots`: cover stray close brackets before a dot
|
|
23
|
+
- [Dev Deps] update `@ljharb/eslint-config`, `eslint`, `tape`
|
|
24
|
+
|
|
1
25
|
## **6.16.0**
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
26
|
+
- [New] `stringify`: add a `depth` option to bound recursion depth (default `Infinity`)
|
|
27
|
+
- [Fix] stringify: serialize Date values when a filter is provided
|
|
28
|
+
- [Fix] `parse`: enforce `arrayLimit` on comma groups under `[]=` when `throwOnLimitExceeded` is set
|
|
29
|
+
- [Fix] `parse`: flatten a collection appended to an overflowed array (#571)
|
|
30
|
+
- [Fix] `utils`: `isBuffer`: do not invoke a non-callable `constructor.isBuffer`
|
|
31
|
+
- [Fix] `stringify`: do not let `allowEmptyArrays` skip cycle detection (or drop own keys) on an empty array with own properties
|
|
32
|
+
- [Fix] `stringify`: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
|
|
33
|
+
- [Docs] threat model: clarify `stringify` deep-nesting DoS is caller-bounded
|
|
34
|
+
- [Docs] clarify `arrayLimit` is a representation threshold, not an element-count cap
|
|
35
|
+
- [Tests] `parse`: remove a test that pinned `[]=` comma groups escaping `arrayLimit`
|
|
36
|
+
- [Tests] `stringify`: pin current `encodeDotInKeys` separator-dot behavior
|
|
37
|
+
- [Dev Deps] update `@ljharb/eslint-config`, `eslint`
|
|
38
|
+
- [Dev Deps] update `eslint`, `evalmd`
|
|
15
39
|
|
|
16
40
|
## **6.15.3**
|
|
17
41
|
- [Fix] `parse`: enforce `throwOnLimitExceeded` for cumulative array growth via `combine`/`merge`
|
|
@@ -29,7 +53,7 @@
|
|
|
29
53
|
- [Fix] `stringify`: use configured `delimiter` after `charsetSentinel` (#555)
|
|
30
54
|
- [Fix] `stringify`: apply `formatter` to encoded key under `strictNullHandling` (#554)
|
|
31
55
|
- [Fix] `stringify`: skip null/undefined filter-array entries instead of crashing in `encoder` (#551)
|
|
32
|
-
- [Fix] `parse`: handle nested bracket groups and add regression tests (#530)
|
|
56
|
+
- [Fix] `parse`: handle nested bracket groups and add regression tests (#530); changes output for some unbalanced bracket keys (see #558)
|
|
33
57
|
- [readme] fix grammar (#550)
|
|
34
58
|
- [Dev Deps] update `@ljharb/eslint-config`
|
|
35
59
|
- [Tests] add regression tests for keys containing percent-encoded bracket text
|
|
@@ -85,6 +85,23 @@ assert.deepEqual(qs.parse('foo[bar][baz]=foobarbaz'), {
|
|
|
85
85
|
});
|
|
86
86
|
```
|
|
87
87
|
|
|
88
|
+
Since v6.14.1 and v6.15.2, `parse` interprets nested bracket groups more consistently. Query strings with unbalanced `[`/`]` can produce different results than in 6.15.1; see [#558](https://github.com/ljharb/qs/issues/558).
|
|
89
|
+
|
|
90
|
+
Because of that bracket grammar,
|
|
91
|
+
**qs** does not agree with `URLSearchParams`,
|
|
92
|
+
`node:querystring`, or any other flat parser about what the "name" of a parameter is,
|
|
93
|
+
and it never has.
|
|
94
|
+
`URLSearchParams` reads `'foo[bar]=baz'` as one flat name `foo[bar]`;
|
|
95
|
+
**qs** reads it as the path `foo.bar`.
|
|
96
|
+
Text that **qs**'s grammar cannot place,
|
|
97
|
+
such as the `extra` in `'foo[bar]extra=baz'`,
|
|
98
|
+
is currently dropped, so several distinct flat names can resolve to the same **qs** path
|
|
99
|
+
(see [#619](https://github.com/ljharb/qs/issues/619)).
|
|
100
|
+
|
|
101
|
+
So validating, authorizing, filtering,
|
|
102
|
+
or signing a query string with one parser and then consuming it with another is unsafe: a deny list or signature computed over `URLSearchParams` names does not constrain what **qs** will produce from the same string.
|
|
103
|
+
Parse the input once, with **qs**, and apply your checks to the resulting object.
|
|
104
|
+
|
|
88
105
|
By default, when nesting objects **qs** will only parse up to 5 children deep.
|
|
89
106
|
This means if you attempt to parse a string like `'a[b][c][d][e][f][g][h][i]=j'` your resulting object will be:
|
|
90
107
|
|
|
@@ -135,7 +152,7 @@ var limited = qs.parse('a=b&c=d', { parameterLimit: 1 });
|
|
|
135
152
|
assert.deepEqual(limited, { a: 'b' });
|
|
136
153
|
```
|
|
137
154
|
|
|
138
|
-
If you want an error to be thrown whenever
|
|
155
|
+
If you want an error to be thrown whenever a limit is exceeded (eg, `parameterLimit`, `arrayLimit`), set the `throwOnLimitExceeded` option to `true`. This option will generate a descriptive error if the query string exceeds a configured limit.
|
|
139
156
|
```javascript
|
|
140
157
|
try {
|
|
141
158
|
qs.parse('a=1&b=2&c=3&d=4', { parameterLimit: 3, throwOnLimitExceeded: true });
|
|
@@ -147,7 +164,7 @@ try {
|
|
|
147
164
|
|
|
148
165
|
When `throwOnLimitExceeded` is set to `false` (default), **qs** will parse up to the specified `parameterLimit` and ignore the rest without throwing an error.
|
|
149
166
|
|
|
150
|
-
Note that `parameterLimit` only bounds the number of `&`-delimited parameters; it does not limit how many values a single parameter expands into. In particular, when `comma: true` is enabled, a single parameter's value is split on commas into arbitrarily many elements, which `parameterLimit` does not constrain.
|
|
167
|
+
Note that `parameterLimit` only bounds the number of `&`-delimited parameters; it does not limit how many values a single parameter expands into. In particular, when `comma: true` is enabled, a single parameter's value is split on commas into arbitrarily many elements, which `parameterLimit` does not constrain. Setting `throwOnLimitExceeded: true` (see `arrayLimit` below) makes **qs** reject a query string with more than `parameterLimit` parameters, one that uses an array index of `arrayLimit` or greater, or one that would produce any array longer than `arrayLimit`, including an array produced by comma splitting. `arrayLimit` applies to each array separately, including each parameter's comma-split value, so the total number of values across all parameters can still reach `parameterLimit` times `arrayLimit`, which is 20,000 at the default limits; always bound the input size at the transport layer as well (e.g. an HTTP body-size limit).
|
|
151
168
|
|
|
152
169
|
To bypass the leading question mark, use `ignoreQueryPrefix`:
|
|
153
170
|
|
|
@@ -293,6 +310,8 @@ assert.deepEqual(withIndexedEmptyString, { a: ['b', '', 'c'] });
|
|
|
293
310
|
Any array members with an index of `20` or greater will instead be converted to an object with the index as the key.
|
|
294
311
|
This is needed to handle cases when someone sent, for example, `a[999999999]` and it will take significant time to iterate over this huge array.
|
|
295
312
|
|
|
313
|
+
Since v6.14.1 and v6.15.2, the arrayLimit now applies to arrays specified using both the `[]` and `[0]` syntaxes.
|
|
314
|
+
|
|
296
315
|
```javascript
|
|
297
316
|
var withMaxIndex = qs.parse('a[100]=b');
|
|
298
317
|
assert.deepEqual(withMaxIndex, { a: { '100': 'b' } });
|
|
@@ -317,7 +336,7 @@ try {
|
|
|
317
336
|
|
|
318
337
|
When `throwOnLimitExceeded` is set to `false` (default), **qs** will parse up to the specified `arrayLimit` and if the limit is exceeded, the array will instead be converted to an object with the index as the key.
|
|
319
338
|
|
|
320
|
-
Note that `arrayLimit` is a *representation* threshold that controls when a numerically-indexed collection switches from an array to an object
|
|
339
|
+
Note that `arrayLimit` is a *representation* threshold that controls when a numerically-indexed collection switches from an array to an object; it is **not** a hard cap on the total number of elements parsed. With the default `throwOnLimitExceeded: false`, exceeding `arrayLimit` never rejects or truncates input; it only changes the container type, and the resulting object still holds every element (so its size stays proportional to the input). This conversion is itself a safeguard: it avoids allocating a huge sparse array for input like `a[999999999]`. If you need a hard limit that rejects oversized arrays in untrusted query strings, set `throwOnLimitExceeded: true`. `throwOnLimitExceeded` still limits each array separately, not the total: with `comma: true`, each comma-separated group under `a[]=` counts as one element of the outer array, and can itself hold up to `arrayLimit` elements.
|
|
321
340
|
|
|
322
341
|
To prevent array syntax (`a[]`, `a[0]`) from being parsed as arrays, set `parseArrays` to `false`.
|
|
323
342
|
Note that duplicate keys (e.g. `a=b&a=c`) may still produce arrays when `duplicates` is `'combine'` (the default).
|
|
@@ -361,6 +380,15 @@ assert.deepEqual(arraysOfObjects, { a: ['b', 'c'] })
|
|
|
361
380
|
```
|
|
362
381
|
(_this cannot convert nested objects, such as `a={b:1},{c:d}`_)
|
|
363
382
|
|
|
383
|
+
With `[]` or index notation, the values from each comma-separated group stay together as one element of the array, while repeated plain keys flatten into one array:
|
|
384
|
+
```javascript
|
|
385
|
+
var nestedGroups = qs.parse('a[]=b,c&a[]=d', { comma: true });
|
|
386
|
+
assert.deepEqual(nestedGroups, { a: [['b', 'c'], 'd'] });
|
|
387
|
+
|
|
388
|
+
var flatGroups = qs.parse('a=b,c&a=d', { comma: true });
|
|
389
|
+
assert.deepEqual(flatGroups, { a: ['b', 'c', 'd'] });
|
|
390
|
+
```
|
|
391
|
+
|
|
364
392
|
### Parsing primitive/scalar values (numbers, booleans, null, etc)
|
|
365
393
|
|
|
366
394
|
By default, all values are parsed as strings.
|
|
@@ -5,13 +5,13 @@
|
|
|
5
5
|
"use strict";var stringify=require(4),parse=require(3),formats=require(1);module.exports={formats:formats,parse:parse,stringify:stringify};
|
|
6
6
|
|
|
7
7
|
},{"1":1,"3":3,"4":4}],3:[function(require,module,exports){
|
|
8
|
-
"use strict";var utils=require(5),has=Object.prototype.hasOwnProperty,isArray=Array.isArray,defaults={allowDots:!1,allowEmptyArrays:!1,allowPrototypes:!1,allowSparse:!1,arrayLimit:20,charset:"utf-8",charsetSentinel:!1,comma:!1,decodeDotInKeys:!1,decoder:utils.decode,delimiter:"&",depth:5,duplicates:"combine",ignoreQueryPrefix:!1,interpretNumericEntities:!1,parameterLimit:1e3,parseArrays:!0,plainObjects:!1,strictDepth:!1,strictMerge:!0,strictNullHandling:!1,throwOnLimitExceeded:!1},interpretNumericEntities=function(e){return e.replace(/&#(\d+);/g,function(e,t){return String.fromCharCode(parseInt(t,10))})},parseArrayValue=function(e,t,r){if(e&&"string"==typeof e&&t.comma&&e.indexOf(",")>-1){if(t.throwOnLimitExceeded)for(var i=0,a=e.indexOf(",");a>-1;){if((i+=1)>=t.arrayLimit)throw new RangeError("Array limit exceeded. Only "+t.arrayLimit+" element"+(1===t.arrayLimit?"":"s")+" allowed in an array.");a=e.indexOf(",",a+1)}return e.split(",")}if(t.throwOnLimitExceeded&&r>=t.arrayLimit)throw new RangeError("Array limit exceeded. Only "+t.arrayLimit+" element"+(1===t.arrayLimit?"":"s")+" allowed in an array.");return e},isoSentinel="utf8=%26%2310003%3B",charsetSentinel="utf8=%E2%9C%93",parseValues=function parseQueryStringValues(e,t){var r={__proto__:null},i=t.ignoreQueryPrefix?e.replace(/^\?/,""):e;i=i.replace(/%5B/gi,"[").replace(/%5D/gi,"]");var a=t.parameterLimit===1/0?void 0:t.parameterLimit,o=i.split(t.delimiter,t.throwOnLimitExceeded&&void 0!==a?a+1:a);if(t.throwOnLimitExceeded&&void 0!==a&&o.length>a)throw new RangeError("Parameter limit exceeded. Only "+a+" parameter"+(1===a?"":"s")+" allowed.");var l
|
|
8
|
+
"use strict";var getSideChannel=require(46),utils=require(5),has=Object.prototype.hasOwnProperty,isArray=Array.isArray,getPrototypeOf=Object.getPrototypeOf,isPlainContainer=function isPlainContainer(e){if(!e||"object"!=typeof e)return!1;if(isArray(e))return!0;var t=getPrototypeOf(e);return t===Object.prototype||null===t},emptyCopyOf=function emptyCopyOf(e){if(isArray(e)){var t=[];return t.length=e.length,t}return null===getPrototypeOf(e)?{__proto__:null}:{}},copyInput=function copyInput(e){for(var t=getSideChannel(),r={},i=[{source:e,target:r}],a=0;a<i.length;++a)for(var o=i[a].source,n=i[a].target,l=Object.keys(o),s=0;s<l.length;++s){var c=o[l[s]];if(isPlainContainer(c)){if(!t.has(c)){var p=emptyCopyOf(c);t.set(c,p),i[i.length]={source:c,target:p}}n[l[s]]=t.get(c)}else n[l[s]]=c}return r},defaults={allowDots:!1,allowEmptyArrays:!1,allowPrototypes:!1,allowSparse:!1,arrayLimit:20,charset:"utf-8",charsetSentinel:!1,comma:!1,decodeDotInKeys:!1,decoder:utils.decode,delimiter:"&",depth:5,duplicates:"combine",ignoreQueryPrefix:!1,interpretNumericEntities:!1,parameterLimit:1e3,parseArrays:!0,plainObjects:!1,strictDepth:!1,strictMerge:!0,strictNullHandling:!1,throwOnLimitExceeded:!1},interpretNumericEntities=function(e){return e.replace(/&#(\d+);/g,function(e,t){return String.fromCharCode(parseInt(t,10))})},parseArrayValue=function(e,t,r){if(e&&"string"==typeof e&&t.comma&&e.indexOf(",")>-1){if(t.throwOnLimitExceeded)for(var i=0,a=e.indexOf(",");a>-1;){if((i+=1)>=t.arrayLimit)throw new RangeError("Array limit exceeded. Only "+t.arrayLimit+" element"+(1===t.arrayLimit?"":"s")+" allowed in an array.");a=e.indexOf(",",a+1)}return e.split(",")}if(t.throwOnLimitExceeded&&r>=t.arrayLimit)throw new RangeError("Array limit exceeded. Only "+t.arrayLimit+" element"+(1===t.arrayLimit?"":"s")+" allowed in an array.");return e},isoSentinel="utf8=%26%2310003%3B",charsetSentinel="utf8=%E2%9C%93",parseValues=function parseQueryStringValues(e,t){var r={__proto__:null},i=t.ignoreQueryPrefix?e.replace(/^\?/,""):e;i=i.replace(/%5B/gi,"[").replace(/%5D/gi,"]");var a=t.parameterLimit===1/0?void 0:t.parameterLimit,o=i.split(t.delimiter,t.throwOnLimitExceeded&&void 0!==a?a+1:a);if(t.throwOnLimitExceeded&&void 0!==a&&o.length>a)throw new RangeError("Parameter limit exceeded. Only "+a+" parameter"+(1===a?"":"s")+" allowed.");var n,l=-1,s=t.charset;if(t.charsetSentinel)for(n=0;n<o.length;++n)0===o[n].indexOf("utf8=")&&(o[n]===charsetSentinel?s="utf-8":o[n]===isoSentinel&&(s="iso-8859-1"),l=n,n=o.length);for(n=0;n<o.length;++n)if(n!==l){var c,p,d=o[n],u=d.indexOf("]="),y=-1===u?d.indexOf("="):u+1,f=y>1&&"[]"===d.slice(y-2,y);if(-1===y?(c=t.decoder(d,defaults.decoder,s,"key"),p=t.strictNullHandling?null:""):null!==(c=t.decoder(d.slice(0,y),defaults.decoder,s,"key"))&&(p=utils.maybeMap(parseArrayValue(d.slice(y+1),t,isArray(r[c])?r[c].length:0),function(e){return t.decoder(e,defaults.decoder,s,"value")})),p&&t.interpretNumericEntities&&"iso-8859-1"===s&&(p=interpretNumericEntities(String(p))),f&&(p=isArray(p)?[p]:p),t.comma&&isArray(p)&&p.length>t.arrayLimit&&(p=utils.combine([],p,t.arrayLimit,t.plainObjects,t.throwOnLimitExceeded)),null!==c){var m=has.call(r,c);m&&("combine"===t.duplicates||f)?r[c]=utils.combine(r[c],p,t.arrayLimit,t.plainObjects,t.throwOnLimitExceeded):m&&"last"!==t.duplicates||(r[c]=p)}}return r},parseObject=function(e,t,r,i){var a=0;if(e.length>0&&"[]"===e[e.length-1]){var o=e.slice(0,-1).join("");a=Array.isArray(t)&&t[o]?t[o].length:0}for(var n=i?t:parseArrayValue(t,r,a),l=e.length-1;l>=0;--l){var s,c=e[l];if("[]"===c&&r.parseArrays)s=utils.isOverflow(n)?n:r.allowEmptyArrays&&(""===n||r.strictNullHandling&&null===n)?[]:utils.combine([],n,r.arrayLimit,r.plainObjects,r.throwOnLimitExceeded);else{s=r.plainObjects?{__proto__:null}:{};var p="["===c.charAt(0)&&"]"===c.charAt(c.length-1)?c.slice(1,-1):c,d=r.decodeDotInKeys?p.replace(/%2E/g,"."):p,u=parseInt(d,10),y=!isNaN(u)&&c!==d&&String(u)===d&&u>=0&&r.parseArrays;if(r.parseArrays||""!==d)if(y&&u<r.arrayLimit)(s=[])[u]=n;else{if(y&&r.throwOnLimitExceeded)throw new RangeError("Array limit exceeded. Only "+r.arrayLimit+" element"+(1===r.arrayLimit?"":"s")+" allowed in an array.");y?(s[u]=n,utils.markOverflow(s,u)):"__proto__"!==d&&(s[d]=n)}else s={0:n}}n=s}return n},topLevelDotsToBrackets=function topLevelDotsToBrackets(e){for(var t="",r=0,i=0;i<e.length;i+=1){var a=e.charCodeAt(i);if(91===a)r+=1,t+="[";else if(93===a)r>0&&(r-=1),t+="]";else if(46===a&&0===r&&i+1<e.length&&46!==e.charCodeAt(i+1)&&91!==e.charCodeAt(i+1)){for(var o=i+1,n=o;n<e.length&&46!==e.charCodeAt(n)&&91!==e.charCodeAt(n);)n+=1;t+="["+e.slice(o,n)+"]",i=n-1}else t+=e.charAt(i)}return t},splitKeyIntoSegments=function splitKeyIntoSegments(e,t){var r=t.allowDots?topLevelDotsToBrackets(e):e;if(t.depth<=0){if(!t.plainObjects&&has.call(Object.prototype,r)&&!t.allowPrototypes)return;return[r]}var i=[],a=r.indexOf("["),o=a>=0?r.slice(0,a):r;if(o){if(!t.plainObjects&&has.call(Object.prototype,o)&&!t.allowPrototypes)return;i[i.length]=o}for(var n=r.length,l=a,s=0;l>=0&&s<t.depth;){for(var c=1,p=l+1,d=-1;p<n&&d<0;){var u=r.charCodeAt(p);91===u?c+=1:93===u&&0==(c-=1)&&(d=p),p+=1}if(d<0)return i[i.length]="["+r.slice(l)+"]",i;var y=r.slice(l,d+1),f=y.slice(1,-1);if(!t.plainObjects&&has.call(Object.prototype,f)&&!t.allowPrototypes)return;i[i.length]=y,s+=1,l=r.indexOf("[",d+1)}if(l>=0){if(!0===t.strictDepth)throw new RangeError("Input depth exceeded depth option of "+t.depth+" and strictDepth is true");i[i.length]="["+r.slice(l)+"]"}return i},parseKeys=function parseQueryStringKeys(e,t,r,i){if(e){var a=splitKeyIntoSegments(e,r);if(a)return parseObject(a,t,r,i)}},normalizeParseOptions=function normalizeParseOptions(e){if(!e)return defaults;if(void 0!==e.allowEmptyArrays&&"boolean"!=typeof e.allowEmptyArrays)throw new TypeError("`allowEmptyArrays` option can only be `true` or `false`, when provided");if(void 0!==e.decodeDotInKeys&&"boolean"!=typeof e.decodeDotInKeys)throw new TypeError("`decodeDotInKeys` option can only be `true` or `false`, when provided");if(null!==e.decoder&&void 0!==e.decoder&&"function"!=typeof e.decoder)throw new TypeError("Decoder has to be a function.");if(void 0!==e.charset&&"utf-8"!==e.charset&&"iso-8859-1"!==e.charset)throw new TypeError("The charset option must be either utf-8, iso-8859-1, or undefined");if(void 0!==e.throwOnLimitExceeded&&"boolean"!=typeof e.throwOnLimitExceeded)throw new TypeError("`throwOnLimitExceeded` option must be a boolean");var t=void 0===e.charset?defaults.charset:e.charset,r=void 0===e.duplicates?defaults.duplicates:e.duplicates;if("combine"!==r&&"first"!==r&&"last"!==r)throw new TypeError("The duplicates option must be either combine, first, or last");return{allowDots:void 0===e.allowDots?!0===e.decodeDotInKeys||defaults.allowDots:!!e.allowDots,allowEmptyArrays:"boolean"==typeof e.allowEmptyArrays?!!e.allowEmptyArrays:defaults.allowEmptyArrays,allowPrototypes:"boolean"==typeof e.allowPrototypes?e.allowPrototypes:defaults.allowPrototypes,allowSparse:"boolean"==typeof e.allowSparse?e.allowSparse:defaults.allowSparse,arrayLimit:"number"==typeof e.arrayLimit?e.arrayLimit:defaults.arrayLimit,charset:t,charsetSentinel:"boolean"==typeof e.charsetSentinel?e.charsetSentinel:defaults.charsetSentinel,comma:"boolean"==typeof e.comma?e.comma:defaults.comma,decodeDotInKeys:"boolean"==typeof e.decodeDotInKeys?e.decodeDotInKeys:defaults.decodeDotInKeys,decoder:"function"==typeof e.decoder?e.decoder:defaults.decoder,delimiter:"string"==typeof e.delimiter||utils.isRegExp(e.delimiter)?e.delimiter:defaults.delimiter,depth:"number"==typeof e.depth||!1===e.depth?+e.depth:defaults.depth,duplicates:r,ignoreQueryPrefix:!0===e.ignoreQueryPrefix,interpretNumericEntities:"boolean"==typeof e.interpretNumericEntities?e.interpretNumericEntities:defaults.interpretNumericEntities,parameterLimit:"number"==typeof e.parameterLimit?e.parameterLimit:defaults.parameterLimit,parseArrays:!1!==e.parseArrays,plainObjects:"boolean"==typeof e.plainObjects?e.plainObjects:defaults.plainObjects,strictDepth:"boolean"==typeof e.strictDepth?!!e.strictDepth:defaults.strictDepth,strictMerge:"boolean"==typeof e.strictMerge?!!e.strictMerge:defaults.strictMerge,strictNullHandling:"boolean"==typeof e.strictNullHandling?e.strictNullHandling:defaults.strictNullHandling,throwOnLimitExceeded:"boolean"==typeof e.throwOnLimitExceeded&&e.throwOnLimitExceeded}};module.exports=function(e,t){var r=normalizeParseOptions(t);if(""===e||null==e)return r.plainObjects?{__proto__:null}:{};for(var i="string"==typeof e?parseValues(e,r):copyInput(e),a=r.plainObjects?{__proto__:null}:{},o=Object.keys(i),n=0;n<o.length;++n){var l=o[n],s=parseKeys(l,i[l],r,"string"==typeof e);a=utils.merge(a,s,r)}return!0===r.allowSparse?a:utils.compact(a)};
|
|
9
9
|
|
|
10
|
-
},{"5":5}],4:[function(require,module,exports){
|
|
11
|
-
"use strict";var getSideChannel=require(46),utils=require(5),formats=require(1),has=Object.prototype.hasOwnProperty,arrayPrefixGenerators={brackets:function brackets(e){return e+"[]"},comma:"comma",indices:function indices(e,r){return e+"["+r+"]"},repeat:function repeat(e){return e}},isArray=Array.isArray,push=Array.prototype.push,pushToArray=function(e,r){push.apply(e,isArray(r)?r:[r])},toISO=Date.prototype.toISOString,defaultFormat=formats.default,defaults={addQueryPrefix:!1,allowDots:!1,allowEmptyArrays:!1,arrayFormat:"indices",charset:"utf-8",charsetSentinel:!1,commaRoundTrip:!1,delimiter:"&",depth:1/0,encode:!0,encodeDotInKeys:!1,encoder:utils.encode,encodeValuesOnly:!1,filter:void 0,format:defaultFormat,formatter:formats.formatters[defaultFormat],indices:!1,serializeDate:function serializeDate(e){return toISO.call(e)},skipNulls:!1,strictNullHandling:!1},isNonNullishPrimitive=function isNonNullishPrimitive(e){return"string"==typeof e||"number"==typeof e||"boolean"==typeof e||"symbol"==typeof e||"bigint"==typeof e},sentinel={},stringify=function stringify(e,r,t,o,n,a,i,l,s,f,u,d,y,
|
|
10
|
+
},{"46":46,"5":5}],4:[function(require,module,exports){
|
|
11
|
+
"use strict";var getSideChannel=require(46),utils=require(5),formats=require(1),has=Object.prototype.hasOwnProperty,arrayPrefixGenerators={brackets:function brackets(e){return e+"[]"},comma:"comma",indices:function indices(e,r){return e+"["+r+"]"},repeat:function repeat(e){return e}},isArray=Array.isArray,push=Array.prototype.push,pushToArray=function(e,r){push.apply(e,isArray(r)?r:[r])},toISO=Date.prototype.toISOString,defaultFormat=formats.default,defaults={addQueryPrefix:!1,allowDots:!1,allowEmptyArrays:!1,arrayFormat:"indices",charset:"utf-8",charsetSentinel:!1,commaRoundTrip:!1,delimiter:"&",depth:1/0,encode:!0,encodeDotInKeys:!1,encoder:utils.encode,encodeValuesOnly:!1,filter:void 0,format:defaultFormat,formatter:formats.formatters[defaultFormat],indices:!1,serializeDate:function serializeDate(e){return toISO.call(e)},skipNulls:!1,strictNullHandling:!1},isNonNullishPrimitive=function isNonNullishPrimitive(e){return"string"==typeof e||"number"==typeof e||"boolean"==typeof e||"symbol"==typeof e||"bigint"==typeof e},sentinel={},stringify=function stringify(e,r,t,o,n,a,i,l,s,f,u,d,c,y,p,m,h,v,g,b){var w=e;if(b>g)throw new RangeError("Input depth exceeded depth option of "+g);for(var D=v,A=0,S=!1;void 0!==(D=D.get(sentinel))&&!S;){var E=D.get(e);if(A+=1,void 0!==E){if(E===A)throw new RangeError("Cyclic object value");S=!0}void 0===D.get(sentinel)&&(A=0)}if((w="function"==typeof f?f(r,w):w)instanceof Date?w=c(w):"comma"===t&&isArray(w)&&(w=utils.maybeMap(w,function(e){return e instanceof Date?c(e):e})),null===w){if(a)return p(s&&!m?s(r,defaults.encoder,h,"key",y):r);w=""}if(isNonNullishPrimitive(w)||utils.isBuffer(w))return s?[p(m?r:s(r,defaults.encoder,h,"key",y))+"="+p(s(w,defaults.encoder,h,"value",y))]:[p(r)+"="+p(String(w))];var N,O=[];if(void 0===w)return O;if("comma"===t&&isArray(w))m&&s&&(w=utils.maybeMap(w,function(e){return null==e?e:s(e,defaults.encoder,h,"value",y)})),N=[{value:w.length>0?utils.toCoercible(w).join(",")||null:void 0}];else if(isArray(f))N=f;else{var T=Object.keys(w);N=u?T.sort(u):T}var k=String(r),I=o&&isArray(w)&&1===w.length?k+"[]":k;if(n&&isArray(w)&&0===w.length&&0===Object.keys(w).length)return I+"[]";for(var P=0;P<N.length;++P){var x=N[P],K="object"==typeof x&&x&&void 0!==x.value?x.value:w[x];if(!i||null!==K){var z=d&&l?String(x).replace(/\./g,"%2E"):String(x),j=isArray(w)?"function"==typeof t?t(I,z):I:I+(d?"."+z:"["+z+"]");v.set(e,A);var F=getSideChannel();F.set(sentinel,v),pushToArray(O,stringify(K,j,t,o,n,a,i,l,"comma"===t&&m&&isArray(w)?null:s,f,u,d,c,y,p,m,h,F,g,b+1))}}return O},normalizeStringifyOptions=function normalizeStringifyOptions(e){if(!e)return defaults;if(void 0!==e.allowEmptyArrays&&"boolean"!=typeof e.allowEmptyArrays)throw new TypeError("`allowEmptyArrays` option can only be `true` or `false`, when provided");if(void 0!==e.encodeDotInKeys&&"boolean"!=typeof e.encodeDotInKeys)throw new TypeError("`encodeDotInKeys` option can only be `true` or `false`, when provided");if(null!==e.encoder&&void 0!==e.encoder&&"function"!=typeof e.encoder)throw new TypeError("Encoder has to be a function.");var r=e.charset||defaults.charset;if(void 0!==e.charset&&"utf-8"!==e.charset&&"iso-8859-1"!==e.charset)throw new TypeError("The charset option must be either utf-8, iso-8859-1, or undefined");var t=formats.default;if(void 0!==e.format){if(!has.call(formats.formatters,e.format))throw new TypeError("Unknown format option provided.");t=e.format}var o,n=formats.formatters[t],a=defaults.filter;if(("function"==typeof e.filter||isArray(e.filter))&&(a=e.filter),o=has.call(arrayPrefixGenerators,e.arrayFormat)?e.arrayFormat:"indices"in e?e.indices?"indices":"repeat":defaults.arrayFormat,"commaRoundTrip"in e&&"boolean"!=typeof e.commaRoundTrip)throw new TypeError("`commaRoundTrip` must be a boolean, or absent");var i=void 0===e.allowDots?!0===e.encodeDotInKeys||defaults.allowDots:!!e.allowDots;return{addQueryPrefix:"boolean"==typeof e.addQueryPrefix?e.addQueryPrefix:defaults.addQueryPrefix,allowDots:i,allowEmptyArrays:"boolean"==typeof e.allowEmptyArrays?!!e.allowEmptyArrays:defaults.allowEmptyArrays,arrayFormat:o,charset:r,charsetSentinel:"boolean"==typeof e.charsetSentinel?e.charsetSentinel:defaults.charsetSentinel,commaRoundTrip:!!e.commaRoundTrip,delimiter:void 0===e.delimiter?defaults.delimiter:e.delimiter,depth:"number"==typeof e.depth?e.depth:defaults.depth,encode:"boolean"==typeof e.encode?e.encode:defaults.encode,encodeDotInKeys:"boolean"==typeof e.encodeDotInKeys?e.encodeDotInKeys:defaults.encodeDotInKeys,encoder:"function"==typeof e.encoder?e.encoder:defaults.encoder,encodeValuesOnly:"boolean"==typeof e.encodeValuesOnly?e.encodeValuesOnly:defaults.encodeValuesOnly,filter:a,format:t,formatter:n,serializeDate:"function"==typeof e.serializeDate?e.serializeDate:defaults.serializeDate,skipNulls:"boolean"==typeof e.skipNulls?e.skipNulls:defaults.skipNulls,sort:"function"==typeof e.sort?e.sort:null,strictNullHandling:"boolean"==typeof e.strictNullHandling?e.strictNullHandling:defaults.strictNullHandling}};module.exports=function(e,r){var t,o=e,n=normalizeStringifyOptions(r);"function"==typeof n.filter?o=(0,n.filter)("",o):isArray(n.filter)&&(t=n.filter);var a=[];if("object"!=typeof o||null===o)return"";var i=arrayPrefixGenerators[n.arrayFormat],l="comma"===i&&n.commaRoundTrip;t||(t=Object.keys(o)),n.sort&&t.sort(n.sort);for(var s=getSideChannel(),f=0;f<t.length;++f){var u=t[f];if(null!=u){var d=o[u];if(!n.skipNulls||null!==d){var c=n.encodeDotInKeys?String(u).replace(/\./g,"%2E"):String(u);pushToArray(a,stringify(d,c,i,l,n.allowEmptyArrays,n.strictNullHandling,n.skipNulls,n.encodeDotInKeys,n.encode?n.encoder:null,n.filter,n.sort,n.allowDots,n.serializeDate,n.format,n.formatter,n.encodeValuesOnly,n.charset,s,n.depth,0))}}}var y=a.join(n.delimiter),p=!0===n.addQueryPrefix?"?":"";return n.charsetSentinel&&("iso-8859-1"===n.charset?p+="utf8=%26%2310003%3B"+n.delimiter:p+="utf8=%E2%9C%93"+n.delimiter),y.length>0?p+y:""};
|
|
12
12
|
|
|
13
13
|
},{"1":1,"46":46,"5":5}],5:[function(require,module,exports){
|
|
14
|
-
"use strict";var formats=require(1),getSideChannel=require(46),defineProperty=require(14),has=Object.prototype.hasOwnProperty,isArray=Array.isArray,overflowChannel=getSideChannel(),markOverflow=function markOverflow(e,r){return overflowChannel.set(e,r),e},isOverflow=function isOverflow(e){return overflowChannel.has(e)},getMaxIndex=function getMaxIndex(e){return overflowChannel.get(e)},setMaxIndex=function setMaxIndex(e,r){overflowChannel.set(e,r)},hexTable=function(){for(var e=[],r=0;r<256;++r)e[e.length]="%"+((r<16?"0":"")+r.toString(16)).toUpperCase();return e}(),compactQueue=function compactQueue(e){for(;e.length>1;){var r=e.pop(),t=r.obj[r.prop];if(isArray(t)){for(var n=[],
|
|
14
|
+
"use strict";var formats=require(1),getSideChannel=require(46),defineProperty=require(14),has=Object.prototype.hasOwnProperty,isArray=Array.isArray,overflowChannel=getSideChannel(),markOverflow=function markOverflow(e,r){return overflowChannel.set(e,r),e},isOverflow=function isOverflow(e){return overflowChannel.has(e)},getMaxIndex=function getMaxIndex(e){return overflowChannel.get(e)},setMaxIndex=function setMaxIndex(e,r){overflowChannel.set(e,r)},conflictChannel=getSideChannel(),markConflict=function markConflict(e,r){return conflictChannel.set(e,r),e},isConflict=function isConflict(e){return conflictChannel.has(e)},getConflictIndex=function getConflictIndex(e){return conflictChannel.get(e)},hexTable=function(){for(var e=[],r=0;r<256;++r)e[e.length]="%"+((r<16?"0":"")+r.toString(16)).toUpperCase();return e}(),compactQueue=function compactQueue(e){for(;e.length>1;){var r=e.pop(),t=r.obj[r.prop];if(isArray(t)){for(var n=[],i=0;i<t.length;++i)void 0!==t[i]&&(n[n.length]=t[i]);r.obj[r.prop]=n}}},arrayToObject=function arrayToObject(e,r){for(var t=r&&r.plainObjects?{__proto__:null}:{},n=0;n<e.length;++n)void 0!==e[n]&&(t[n]=e[n]);return t},setProperty=function setProperty(e,r,t){"__proto__"===r&&defineProperty?defineProperty(e,r,{configurable:!0,enumerable:!0,value:t,writable:!0}):e[r]=t},maxNumericIndex=function maxNumericIndex(e,r){for(var t=r,n=Object.keys(e),i=0;i<n.length;++i){var o=parseInt(n[i],10);String(o)===n[i]&&o>t&&(t=o)}return t},limitedPair=function limitedPair(e,r,t){var n=[e,r];if(t&&"number"==typeof t.arrayLimit&&n.length>t.arrayLimit){if(t.throwOnLimitExceeded)throw new RangeError("Array limit exceeded. Only "+t.arrayLimit+" element"+(1===t.arrayLimit?"":"s")+" allowed in an array.");return markOverflow(arrayToObject(n,t),1)}return n},merge=function merge(e,r,t){if(!r)return e;if("object"!=typeof r&&"function"!=typeof r){if(isArray(e)){var n=e.length;if(t&&"number"==typeof t.arrayLimit&&n>=t.arrayLimit){if(t.throwOnLimitExceeded)throw new RangeError("Array limit exceeded. Only "+t.arrayLimit+" element"+(1===t.arrayLimit?"":"s")+" allowed in an array.");return markOverflow(arrayToObject(e.concat(r),t),n)}e[n]=r}else{if(!e||"object"!=typeof e)return limitedPair(e,r,t);if(isOverflow(e)){var i=getMaxIndex(e)+1;e[i]=r,setMaxIndex(e,i)}else if(t&&t.strictMerge&&isConflict(e)){var o=getConflictIndex(e)+1;if(t.throwOnLimitExceeded&&"number"==typeof t.arrayLimit&&o>=t.arrayLimit)throw new RangeError("Array limit exceeded. Only "+t.arrayLimit+" element"+(1===t.arrayLimit?"":"s")+" allowed in an array.");e[o]=r,markConflict(e,o)}else{if(t&&t.strictMerge){var a=limitedPair(e,r,t);return isArray(a)?markConflict(a,1):a}(t&&(t.plainObjects||t.allowPrototypes)||!has.call(Object.prototype,r))&&(e[r]=!0)}}return e}if(!e||"object"!=typeof e){if(isOverflow(r)){for(var l=Object.keys(r),f=t&&t.plainObjects?{__proto__:null,0:e}:{0:e},c=0;c<l.length;c++)f[parseInt(l[c],10)+1]=r[l[c]];return markOverflow(f,getMaxIndex(r)+1)}var y=[e].concat(r);if(t&&"number"==typeof t.arrayLimit&&y.length>t.arrayLimit){if(t.throwOnLimitExceeded)throw new RangeError("Array limit exceeded. Only "+t.arrayLimit+" element"+(1===t.arrayLimit?"":"s")+" allowed in an array.");return markOverflow(arrayToObject(y,t),y.length-1)}return y}var u=e;if(isArray(e)&&!isArray(r)&&(u=arrayToObject(e,t),isConflict(e)&&markConflict(u,e.length-1)),isArray(e)&&isArray(r)){if(r.forEach(function(r,n){if(has.call(e,n)){var i=e[n];i&&"object"==typeof i&&r&&"object"==typeof r?e[n]=merge(i,r,t):e[e.length]=r}else e[n]=r}),t&&"number"==typeof t.arrayLimit&&e.length>t.arrayLimit){if(t.throwOnLimitExceeded)throw new RangeError("Array limit exceeded. Only "+t.arrayLimit+" element"+(1===t.arrayLimit?"":"s")+" allowed in an array.");return markOverflow(arrayToObject(e,t),e.length-1)}return e}return Object.keys(r).reduce(function(e,n){var i=r[n];if(has.call(e,n)?setProperty(e,n,merge(e[n],i,t)):setProperty(e,n,i),isOverflow(r)&&!isOverflow(e)&&markOverflow(e,maxNumericIndex(e,getMaxIndex(r))),isOverflow(e)){var o=parseInt(n,10);String(o)===n&&o>=0&&o>getMaxIndex(e)&&setMaxIndex(e,o)}if(isConflict(e)){var a=parseInt(n,10);String(a)===n&&a>getConflictIndex(e)&&markConflict(e,a)}return e},u)},assign=function assignSingleSource(e,r){return Object.keys(r).reduce(function(e,t){return setProperty(e,t,r[t]),e},e)},decode=function(e,r,t){if("string"==typeof e&&-1===e.indexOf("%"))return-1===e.indexOf("+")?e:e.replace(/\+/g," ");var n=e.replace(/\+/g," ");if("iso-8859-1"===t)return n.replace(/%[0-9a-f]{2}/gi,unescape);try{return decodeURIComponent(n)}catch(e){return n}},hasToPrimitive="function"==typeof Symbol&&"symbol"==typeof Symbol.toPrimitive,arrayJoin=Array.prototype.join,arrayToString=Array.prototype.toString,objectToString=Object.prototype.toString,toCoercible=function toCoercible(e,r){if(!e||"object"!=typeof e&&"function"!=typeof e)return e;if(hasToPrimitive&&null!=e[Symbol.toPrimitive])return e;if(isArray(e)&&e.toString===arrayToString&&e.join===arrayJoin){var t,n=r||getSideChannel();if(n.has(e))return"";n.set(e,!0);for(var i=0;i<e.length;i+=1){var o=e[i],a=toCoercible(o,n);if(!t&&a!==o){t=[];for(var l=0;l<i;l+=1)t[l]=e[l]}t&&(t[i]=a)}return n.delete(e),t||e}if("function"==typeof e.toString)return e;var f=e.valueOf;if("function"==typeof f){var c=f.call(e);if(!c||"object"!=typeof c&&"function"!=typeof c)return String(c)}return objectToString.call(e)},limit=1024,encode=function encode(e,r,t,n,i){if(0===e.length)return e;var o=e;if("symbol"==typeof e?o=Symbol.prototype.toString.call(e):"string"!=typeof e&&(o=String(toCoercible(e))),"iso-8859-1"===t)return escape(o).replace(/%u[0-9a-f]{4}/gi,function(e){return"%26%23"+parseInt(e.slice(2),16)+"%3B"}).replace(/\+/g,"%2B");for(var a="",l=0;l<o.length;l+=limit){var f=o.length>=limit?o.slice(l,l+limit):o;if(l+limit<o.length){var c=f.charCodeAt(f.length-1);c>=55296&&c<=56319&&(f=f.slice(0,-1),l-=1)}for(var y=[],u=0;u<f.length;++u){var s=f.charCodeAt(u);45===s||46===s||95===s||126===s||s>=48&&s<=57||s>=65&&s<=90||s>=97&&s<=122||i===formats.RFC1738&&(40===s||41===s)?y[y.length]=f.charAt(u):s<128?y[y.length]=hexTable[s]:s<2048?y[y.length]=hexTable[192|s>>6]+hexTable[128|63&s]:s<55296||s>=57344?y[y.length]=hexTable[224|s>>12]+hexTable[128|s>>6&63]+hexTable[128|63&s]:(u+=1,s=65536+((1023&s)<<10|1023&f.charCodeAt(u)),y[y.length]=hexTable[240|s>>18]+hexTable[128|s>>12&63]+hexTable[128|s>>6&63]+hexTable[128|63&s])}a+=y.join("")}return a},compact=function compact(e){for(var r=[{obj:{o:e},prop:"o"}],t=getSideChannel(),n=0;n<r.length;++n)for(var i=r[n],o=i.obj[i.prop],a=Object.keys(o),l=0;l<a.length;++l){var f=a[l],c=o[f];"object"!=typeof c||null===c||t.has(c)||(r[r.length]={obj:o,prop:f},t.set(c,!0))}return compactQueue(r),e},isRegExp=function isRegExp(e){return"[object RegExp]"===Object.prototype.toString.call(e)},isBuffer=function isBuffer(e){return!(!e||"object"!=typeof e||!e.constructor||"function"!=typeof e.constructor.isBuffer||!e.constructor.isBuffer(e))},combine=function combine(e,r,t,n,i){if(isOverflow(e)){if(i)throw new RangeError("Array limit exceeded. Only "+t+" element"+(1===t?"":"s")+" allowed in an array.");for(var o=isArray(r)?r:[r],a=getMaxIndex(e),l=0;l<o.length;++l)e[a+=1]=o[l];return setMaxIndex(e,a),e}var f=[].concat(e,r);if(f.length>t){if(i)throw new RangeError("Array limit exceeded. Only "+t+" element"+(1===t?"":"s")+" allowed in an array.");return markOverflow(arrayToObject(f,{plainObjects:n}),f.length-1)}return f},maybeMap=function maybeMap(e,r){if(isArray(e)){for(var t=[],n=0;n<e.length;n+=1)t[t.length]=r(e[n]);return t}return r(e)};module.exports={/* common-shake removed: arrayToObject:arrayToObject *//* common-shake removed: assign:assign */combine:combine,compact:compact,decode:decode,encode:encode,isBuffer:isBuffer,isOverflow:isOverflow,isRegExp:isRegExp,markOverflow:markOverflow,maybeMap:maybeMap,merge:merge,toCoercible:toCoercible};
|
|
15
15
|
|
|
16
16
|
},{"1":1,"14":14,"46":46}],46:[function(require,module,exports){
|
|
17
17
|
"use strict";var $TypeError=require(20),inspect=require(42),getSideChannelList=require(43),getSideChannelMap=require(44),getSideChannelWeakMap=require(45),makeChannel=getSideChannelWeakMap||getSideChannelMap||getSideChannelList;module.exports=function getSideChannel(){var e,n={assert:function(e){if(!n.has(e)){var t=e&&Object(e)===e?"the given object key":inspect(e);throw new $TypeError("Side channel does not contain "+t)}},delete:function(n){return!!e&&e.delete(n)},get:function(n){return e&&e.get(n)},has:function(n){return!!e&&e.has(n)},set:function(n,t){e||(e=makeChannel()),e.set(n,t)}};return n};
|
|
@@ -78,40 +78,40 @@
|
|
|
78
78
|
},{}],23:[function(require,module,exports){
|
|
79
79
|
"use strict";var ERROR_MESSAGE="Function.prototype.bind called on incompatible ",toStr=Object.prototype.toString,max=Math.max,funcType="[object Function]",concatty=function concatty(t,n){for(var r=[],o=0;o<t.length;o+=1)r[o]=t[o];for(var e=0;e<n.length;e+=1)r[e+t.length]=n[e];return r},slicy=function slicy(t,n){for(var r=[],o=n||0,e=0;o<t.length;o+=1,e+=1)r[e]=t[o];return r},joiny=function(t,n){for(var r="",o=0;o<t.length;o+=1)r+=t[o],o+1<t.length&&(r+=n);return r};module.exports=function bind(t){var n=this;if("function"!=typeof n||toStr.apply(n)!==funcType)throw new TypeError(ERROR_MESSAGE+n);for(var r,o=slicy(arguments,1),e=max(0,n.length-o.length),i=[],c=0;c<e;c++)i[c]="$"+c;if(r=Function("binder","return function ("+joiny(i,",")+"){ return binder.apply(this,arguments); }")(function(){if(this instanceof r){var e=n.apply(this,concatty(o,arguments));return Object(e)===e?e:this}return n.apply(t,concatty(o,arguments))}),n.prototype){var p=function Empty(){};p.prototype=n.prototype,r.prototype=new p,p.prototype=null}return r};
|
|
80
80
|
|
|
81
|
+
},{}],39:[function(require,module,exports){
|
|
82
|
+
"use strict";module.exports=Math.pow;
|
|
83
|
+
|
|
81
84
|
},{}],35:[function(require,module,exports){
|
|
82
85
|
"use strict";module.exports=Math.floor;
|
|
83
86
|
|
|
87
|
+
},{}],38:[function(require,module,exports){
|
|
88
|
+
"use strict";module.exports=Math.min;
|
|
89
|
+
|
|
84
90
|
},{}],34:[function(require,module,exports){
|
|
85
91
|
"use strict";module.exports=Math.abs;
|
|
86
92
|
|
|
87
|
-
},{}],37:[function(require,module,exports){
|
|
88
|
-
"use strict";module.exports=Math.max;
|
|
89
|
-
|
|
90
|
-
},{}],39:[function(require,module,exports){
|
|
91
|
-
"use strict";module.exports=Math.pow;
|
|
92
|
-
|
|
93
93
|
},{}],40:[function(require,module,exports){
|
|
94
94
|
"use strict";module.exports=Math.round;
|
|
95
95
|
|
|
96
|
-
},{}],
|
|
97
|
-
"use strict";module.exports=Math.
|
|
96
|
+
},{}],37:[function(require,module,exports){
|
|
97
|
+
"use strict";module.exports=Math.max;
|
|
98
98
|
|
|
99
99
|
},{}],27:[function(require,module,exports){
|
|
100
100
|
"use strict";module.exports="undefined"!=typeof Reflect&&Reflect.getPrototypeOf||null;
|
|
101
101
|
|
|
102
|
-
},{}],
|
|
103
|
-
"use strict";var $Object=require(22);module.exports=$Object.getPrototypeOf||null;
|
|
104
|
-
|
|
105
|
-
},{"22":22}],41:[function(require,module,exports){
|
|
102
|
+
},{}],41:[function(require,module,exports){
|
|
106
103
|
"use strict";var $isNaN=require(36);module.exports=function sign(i){return $isNaN(i)||0===i?i:i<0?-1:1};
|
|
107
104
|
|
|
108
|
-
},{"36":36}],
|
|
109
|
-
"use strict";var
|
|
105
|
+
},{"36":36}],26:[function(require,module,exports){
|
|
106
|
+
"use strict";var $Object=require(22);module.exports=$Object.getPrototypeOf||null;
|
|
110
107
|
|
|
111
|
-
},{"
|
|
108
|
+
},{"22":22}],31:[function(require,module,exports){
|
|
112
109
|
"use strict";var origSymbol="undefined"!=typeof Symbol&&Symbol,hasSymbolSham=require(32);module.exports=function hasNativeSymbols(){return"function"==typeof origSymbol&&"function"==typeof Symbol&&"symbol"==typeof origSymbol("foo")&&"symbol"==typeof Symbol("bar")&&hasSymbolSham()};
|
|
113
110
|
|
|
114
|
-
},{"32":32}],
|
|
111
|
+
},{"32":32}],33:[function(require,module,exports){
|
|
112
|
+
"use strict";var call=Function.prototype.call,$hasOwn=Object.prototype.hasOwnProperty,bind=require(24);module.exports=bind.call(call,$hasOwn);
|
|
113
|
+
|
|
114
|
+
},{"24":24}],28:[function(require,module,exports){
|
|
115
115
|
"use strict";var reflectGetProto=require(27),originalGetProto=require(26),getDunderProto=require(13);module.exports=reflectGetProto?function getProto(t){return reflectGetProto(t)}:originalGetProto?function getProto(t){if(!t||"object"!=typeof t&&"function"!=typeof t)throw new TypeError("getProto: not an object");return originalGetProto(t)}:getDunderProto?function getProto(t){return getDunderProto(t)}:null;
|
|
116
116
|
|
|
117
117
|
},{"13":13,"26":26,"27":27}],29:[function(require,module,exports){
|