@psnext/slingcli 3.5.20261026-1 → 3.6.20261105-1

package/node_modules/qs/test/parse.js

@@ -1,6 +1,7 @@
 'use strict';
 
 var test = require('tape');
+var forEach = require('for-each');
 var hasPropertyDescriptors = require('has-property-descriptors')();
 var iconv = require('iconv-lite');
 var mockProperty = require('mock-property');
@@ -98,6 +99,21 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('decode dot keys with case-insensitive percent escapes', function (st) {
+        var input = 'name%252eobj.first%252ename=John&name%252Eobj.last%252Ename=Doe';
+        st.deepEqual(
+            qs.parse(input, { decodeDotInKeys: true }),
+            { 'name.obj': { 'first.name': 'John', 'last.name': 'Doe' } },
+            'lowercase and uppercase escapes decode in both parent and child keys'
+        );
+        st.deepEqual(
+            qs.parse(input, { allowDots: true, decodeDotInKeys: false }),
+            { 'name%2eobj': { 'first%2ename': 'John' }, 'name%2Eobj': { 'last%2Ename': 'Doe' } },
+            'escaped dots remain unchanged when decoding is disabled'
+        );
+        st.end();
+    });
+
     t.test('decode dot keys correctly', function (st) {
         st.deepEqual(
             qs.parse('name%252Eobj.first=John&name%252Eobj.last=Doe', { allowDots: false, decodeDotInKeys: false }),
@@ -258,8 +274,34 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('ignores bracket-wrapped prototype keys when depth = 0 and allowPrototypes is false', function (st) {
+        st.deepEqual(qs.parse('[toString]=foo', { depth: 0 }), {}, 'the stored key is the bracket content');
+        st.deepEqual(qs.parse('[hasOwnProperty]=bar', { depth: 0 }), {});
+        st.deepEqual(qs.parse('%5BhasOwnProperty%5D=bar', { depth: 0 }), {}, 'percent-encoded brackets');
+        st.deepEqual(qs.parse('[toString]=foo&a=b', { depth: 0 }), { a: 'b' });
+        st.deepEqual(qs.parse('[toString]=foo', { depth: false }), {}, 'depth: false');
+        st.deepEqual(qs.parse('.toString=foo', { depth: 0, allowDots: true }), {}, 'a leading dot becomes a bracket group');
+        st.deepEqual(qs.parse('[a]=b&[toString]=foo', { depth: 0 }), { a: 'b' }, 'other bracket-wrapped keys still strip their brackets');
+        st.end();
+    });
+
     t.test('allows prototype keys when depth = 0 and allowPrototypes is true', function (st) {
         st.deepEqual(qs.parse('toString=foo', { depth: 0, allowPrototypes: true }), { toString: 'foo' });
+        st.deepEqual(qs.parse('[toString]=foo', { depth: 0, allowPrototypes: true }), { toString: 'foo' });
+        st.end();
+    });
+
+    t.test('keeps bracket-wrapped prototype keys when depth = 0 and plainObjects is true', function (st) {
+        var result = qs.parse('[toString]=foo', { depth: 0, plainObjects: true });
+        st.deepEqual(result, { __proto__: null, toString: 'foo' });
+        st.equal(Object.getPrototypeOf(result), null);
+        st.end();
+    });
+
+    t.test('strips one wrapping bracket pair from the key when depth = 0', function (st) {
+        st.deepEqual(qs.parse('[a]=b', { depth: 0 }), { a: 'b' });
+        st.deepEqual(qs.parse('[[toString]]=foo', { depth: 0 }), { '[toString]': 'foo' }, 'only the outer pair is stripped');
+        st.deepEqual(qs.parse('x[toString]=foo', { depth: 0 }), { 'x[toString]': 'foo' }, 'a key with a parent stays literal');
         st.end();
     });
 
@@ -1139,6 +1181,67 @@ test('parse()', function (t) {
         st.end();
     });
 
+    var withOwnProto = function (value) {
+        var obj = {};
+        Object.defineProperty(obj, '__proto__', {
+            configurable: true,
+            enumerable: true,
+            value: value,
+            writable: true
+        });
+        return obj;
+    };
+    // node < 0.12 reads an own `__proto__` data property as `Object.prototype`, so it can not be copied by value
+    var ownProtoIsReadable = withOwnProto(1).__proto__ === 1; // eslint-disable-line no-proto
+
+    t.test('object-valued input with only an own `__proto__` does not mutate sub-object [[Prototype]]', function (st) {
+        // `JSON.parse` in node < 0.12 sets the [[Prototype]] instead of creating an own `__proto__`
+        var out = qs.parse({ user: withOwnProto({ isAdmin: true }) });
+
+        st.equal(out.user.isAdmin, undefined, 'attacker-controlled inherited property is not exposed');
+        st.equal(Object.getPrototypeOf(out.user), Object.prototype, 'sub-object [[Prototype]] is unchanged');
+        st.equal(Object.prototype.isAdmin, undefined, 'Object.prototype is not polluted');
+
+        var sibling = withOwnProto({ isAdmin: true });
+        sibling.name = 'alice';
+        var withSibling = qs.parse({ user: sibling });
+
+        st.equal(withSibling.user.name, 'alice', 'sibling key is preserved');
+        st.equal(withSibling.user.isAdmin, undefined, 'a sibling key does not hide an inherited property');
+        st.equal(Object.getPrototypeOf(withSibling.user), Object.prototype, 'a sibling key does not change [[Prototype]]');
+
+        st.end();
+    });
+
+    t.test('object-valued input keeps an own `__proto__` as a data property', { skip: !ownProtoIsReadable }, function (st) {
+        var descriptor = function (value) {
+            return {
+                configurable: true,
+                enumerable: true,
+                value: value,
+                writable: true
+            };
+        };
+
+        st.deepEqual(
+            Object.getOwnPropertyDescriptor(qs.parse({ user: withOwnProto({ isAdmin: true }) }).user, '__proto__'),
+            descriptor({ isAdmin: true }),
+            'an object value is stored as a data property'
+        );
+        st.deepEqual(
+            Object.getOwnPropertyDescriptor(qs.parse({ user: withOwnProto('admin') }).user, '__proto__'),
+            descriptor('admin'),
+            'a primitive value is stored as a data property'
+        );
+        st.deepEqual(
+            Object.getOwnPropertyDescriptor(qs.parse({ 'user[name]': 'alice', user: withOwnProto({ isAdmin: true }) }).user, '__proto__'),
+            descriptor({ isAdmin: true }),
+            'it survives a merge with a bracket key'
+        );
+
+        st.end();
+    });
+
     t.test('can return null objects', { skip: !hasProto }, function (st) {
         var expected = {
             __proto__: null,
@@ -1162,6 +1265,19 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('returns null objects for empty brackets when parseArrays is false', { skip: !hasProto }, function (st) {
+        st.deepEqual(
+            qs.parse('a[]=b', { parseArrays: false, plainObjects: true }),
+            { __proto__: null, a: { __proto__: null, 0: 'b' } }
+        );
+        st.deepEqual(
+            qs.parse('a[]=b&a[hasOwnProperty]=c', { parseArrays: false, plainObjects: true }),
+            { __proto__: null, a: { __proto__: null, 0: 'b', hasOwnProperty: 'c' } },
+            'prototype keys land on a null object'
+        );
+        st.end();
+    });
+
     t.test('can parse with custom encoding', function (st) {
         st.deepEqual(qs.parse('%8c%a7=%91%e5%8d%e3%95%7b', {
             decoder: function (str) {
@@ -1254,6 +1370,31 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('interprets numeric entities above U+FFFF as surrogate pairs', function (st) {
+        var options = { charset: 'iso-8859-1', interpretNumericEntities: true };
+        st.deepEqual(qs.parse('foo=%26%23128512%3B', options), { foo: '\uD83D\uDE00' }, 'U+1F600, which a browser submits as `&#128512;` from an iso-8859-1 form');
+        st.deepEqual(qs.parse('foo=%26%2365536%3B', options), { foo: '\uD800\uDC00' }, 'U+10000');
+        st.deepEqual(qs.parse('foo=%26%231114111%3B', options), { foo: '\uDBFF\uDFFF' }, 'U+10FFFF');
+        st.deepEqual(qs.parse('foo=%26%2365535%3B', options), { foo: '\uFFFF' }, 'U+FFFF is still one code unit');
+        st.end();
+    });
+
+    t.test('interprets numeric entities in each value, but not in keys', function (st) {
+        var options = { charset: 'iso-8859-1', interpretNumericEntities: true };
+        st.deepEqual(qs.parse('a=' + urlEncodedNumSmiley + ',x', options), { a: '☺,x' }, 'a value with commas stays one string without `comma`');
+        st.deepEqual(qs.parse('a' + urlEncodedNumSmiley + '=x', options), { 'a&#9786;': 'x' }, 'keys are not interpreted');
+        st.deepEqual(qs.parse('a[]=' + urlEncodedNumSmiley + '&a[]=x', options), { a: ['☺', 'x'] }, 'bracket array values');
+        st.deepEqual(qs.parse('a=' + urlEncodedNumSmiley + '&a=x', options), { a: ['☺', 'x'] }, 'repeated key values');
+        st.deepEqual(qs.parse('a[b]=' + urlEncodedNumSmiley, options), { a: { b: '☺' } }, 'nested key values');
+        st.deepEqual(
+            qs.parse('utf8=%26%2310003%3B&a=' + urlEncodedNumSmiley, { charsetSentinel: true, interpretNumericEntities: true }),
+            { a: '☺' },
+            'an iso-8859-1 charset sentinel enables interpretation'
+        );
+        st.deepEqual(qs.parse('a=' + urlEncodedNumSmiley + ',x', { charset: 'iso-8859-1', comma: true }), { a: ['&#9786;', 'x'] }, '`comma` splits without `interpretNumericEntities`');
+        st.end();
+    });
+
     t.test('handles a custom decoder returning `null`, in the `iso-8859-1` charset, when `interpretNumericEntities`', function (st) {
         st.deepEqual(qs.parse('foo=&bar=' + urlEncodedNumSmiley, {
             charset: 'iso-8859-1',
@@ -1289,15 +1430,70 @@ test('parse()', function (t) {
         st.end();
     });
 
-    t.test('interpretNumericEntities with comma:true and iso charset does not crash', function (st) {
+    t.test('interpretNumericEntities preserves comma arrays in iso charset', function (st) {
         st.deepEqual(
             qs.parse('b&a[]=1,' + urlEncodedNumSmiley, { comma: true, charset: 'iso-8859-1', interpretNumericEntities: true }),
-            { b: '', a: ['1,☺'] }
+            { b: '', a: [['1', '☺']] }
         );
 
         st.end();
     });
 
+    t.test('interprets numeric entities per comma-separated value', function (st) {
+        var options = { comma: true, charset: 'iso-8859-1', interpretNumericEntities: true };
+        st.deepEqual(qs.parse('a=b,c', options), { a: ['b', 'c'] });
+        st.deepEqual(qs.parse('a=' + urlEncodedNumSmiley + ',%26%239786%3B', options), { a: ['☺', '☺'] });
+        st.deepEqual(qs.parse('a=%26%2344%3B,b%2Cc', options), { a: [',', 'b,c'] });
+        st.deepEqual(qs.parse('a=,b,', options), { a: ['', 'b', ''] });
+        st.deepEqual(qs.parse('a=b,c&a=d,e', options), { a: ['b', 'c', 'd', 'e'] });
+        st.deepEqual(qs.parse('a[]=b,c&a[]=d,e', options), { a: [['b', 'c'], ['d', 'e']] });
+        st.deepEqual(qs.parse('a[0]=b,c', options), { a: [['b', 'c']] });
+        st.deepEqual(qs.parse('utf8=%26%2310003%3B&a=b,' + urlEncodedNumSmiley, {
+            comma: true,
+            charsetSentinel: true,
+            interpretNumericEntities: true
+        }), { a: ['b', '☺'] });
+        st.deepEqual(qs.parse('a=b,c,d', {
+            comma: true,
+            charset: 'iso-8859-1',
+            interpretNumericEntities: true,
+            arrayLimit: 2
+        }), { a: { 0: 'b', 1: 'c', 2: 'd' } });
+        st['throws'](function () {
+            qs.parse('a=b,c,d', {
+                comma: true,
+                charset: 'iso-8859-1',
+                interpretNumericEntities: true,
+                arrayLimit: 2,
+                throwOnLimitExceeded: true
+            });
+        }, RangeError);
+        st.end();
+    });
+
+    t.test('preserves falsy decoder results inside comma arrays', function (st) {
+        st.deepEqual(qs.parse('a=null,0,false,' + urlEncodedNumSmiley, {
+            comma: true,
+            charset: 'iso-8859-1',
+            interpretNumericEntities: true,
+            decoder: function (str, defaultDecoder, charset, type) {
+                if (type === 'value') {
+                    if (str === 'null') {
+                        return null;
+                    }
+                    if (str === '0') {
+                        return 0;
+                    }
+                    if (str === 'false') {
+                        return false;
+                    }
+                }
+                return defaultDecoder(str, defaultDecoder, charset, type);
+            }
+        }), { a: [null, 0, false, '☺'] });
+        st.end();
+    });
+
     t.test('does not interpret %uXXXX syntax in iso-8859-1 mode', function (st) {
         st.deepEqual(qs.parse('%u263A=%u263A', { charset: 'iso-8859-1' }), { '%u263A': '%u263A' });
         st.end();
@@ -1421,6 +1617,41 @@ test('parse()', function (t) {
             sst.end();
         });
 
+        st.test('zero and negative arrayLimit allow non-array values', function (sst) {
+            forEach([0, -1], function (arrayLimit) {
+                var options = { arrayLimit: arrayLimit, throwOnLimitExceeded: true };
+                var label = 'arrayLimit ' + arrayLimit;
+                sst.deepEqual(qs.parse('a=b&c[d]=e', options), { a: 'b', c: { d: 'e' } }, label + ': query string fields');
+                sst.deepEqual(qs.parse('a=b', { arrayLimit: arrayLimit, throwOnLimitExceeded: true, comma: true }), { a: 'b' }, label + ': a value without commas when comma is enabled');
+                sst.deepEqual(qs.parse({ a: 'b', 'c[d]': 'e' }, options), { a: 'b', c: { d: 'e' } }, label + ': object input fields');
+                sst.deepEqual(qs.parse({ a: [] }, options), { a: [] }, label + ': an empty input array has no elements');
+                sst.deepEqual(
+                    qs.parse('a=b&a=c', { arrayLimit: arrayLimit, throwOnLimitExceeded: true, duplicates: 'last' }),
+                    { a: 'c' },
+                    label + ': replacing a duplicate does not create an array'
+                );
+                sst.deepEqual(
+                    qs.parse('a[]=', { arrayLimit: arrayLimit, throwOnLimitExceeded: true, allowEmptyArrays: true }),
+                    { a: [] },
+                    label + ': an empty array has no elements to exceed the limit'
+                );
+                sst.deepEqual(qs.parse({ a: ['b'] }, options), { a: ['b'] }, label + ': an array value in object input is left as-is');
+                sst.deepEqual(qs.parse({ 'a[b]': ['x'] }, options), { a: { b: ['x'] } }, label + ': an array value under a nested key in object input is left as-is');
+                sst.deepEqual(qs.parse('a.b=c', { arrayLimit: arrayLimit, throwOnLimitExceeded: true, allowDots: true }), { a: { b: 'c' } }, label + ': dotted keys');
+                sst.deepEqual(
+                    qs.parse('a=b&a=c', { arrayLimit: arrayLimit, throwOnLimitExceeded: true, duplicates: 'first' }),
+                    { a: 'b' },
+                    label + ': keeping the first duplicate does not create an array'
+                );
+                sst.deepEqual(
+                    qs.parse('a[]=b', { arrayLimit: arrayLimit, throwOnLimitExceeded: true, parseArrays: false }),
+                    { a: { 0: 'b' } },
+                    label + ': array syntax with parseArrays false does not create an array'
+                );
+            });
+            sst.end();
+        });
+
         st.test('does not throw when at limit', function (sst) {
             // 3 elements = limit of 3, should not throw
             var result = qs.parse('a[]=1&a[]=2&a[]=3', { arrayLimit: 3, throwOnLimitExceeded: true });
@@ -1429,6 +1660,58 @@ test('parse()', function (t) {
             sst.end();
         });
 
+        st.test('zero and negative arrayLimit', function (sst) {
+            forEach([0, -1], function (arrayLimit) {
+                var options = { arrayLimit: arrayLimit };
+                var throwOptions = { arrayLimit: arrayLimit, throwOnLimitExceeded: true };
+                var label = 'arrayLimit ' + arrayLimit;
+
+                sst.deepEqual(qs.parse('a=b&c[d]=e', options), { a: 'b', c: { d: 'e' } }, label + ': scalar and object fields are unaffected');
+                sst.deepEqual(qs.parse('a[]=b', options), { a: { 0: 'b' } }, label + ': a bracket array becomes an object');
+                sst.deepEqual(qs.parse('a[]=b&a[]=c', options), { a: { 0: 'b', 1: 'c' } }, label + ': a multi-element bracket array becomes an object');
+                sst.deepEqual(qs.parse('a[0]=b', options), { a: { 0: 'b' } }, label + ': an indexed array becomes an object');
+                sst.deepEqual(qs.parse('a=b&a=c', options), { a: { 0: 'b', 1: 'c' } }, label + ': combined duplicates become an object');
+                sst.deepEqual(qs.parse('a[]=', options), { a: { 0: '' } }, label + ': an empty-string element still counts as an element');
+                sst.deepEqual(qs.parse('a[]=', { arrayLimit: arrayLimit, allowEmptyArrays: true }), { a: [] }, label + ': an empty array has no elements');
+                sst.deepEqual(qs.parse({ 'a[]': 'b' }, options), { a: { 0: 'b' } }, label + ': a bracket key in object input becomes an object');
+                sst.deepEqual(qs.parse({ a: ['b'] }, options), { a: ['b'] }, label + ': an array value in object input is left as-is');
+                sst.deepEqual(qs.parse({ a: [] }, options), { a: [] }, label + ': an empty array value in object input is left as-is');
+
+                var error = arrayLimit === 0
+                    ? new RangeError('Array limit exceeded. Only 0 elements allowed in an array.')
+                    : RangeError;
+                sst['throws'](function () { qs.parse('a[]=b', throwOptions); }, error, label + ': throws on a bracket array');
+                sst['throws'](function () { qs.parse('a[0]=b', throwOptions); }, error, label + ': throws on an indexed array');
+                sst['throws'](function () { qs.parse('a=b&a=c', throwOptions); }, error, label + ': throws on combined duplicates');
+                sst['throws'](function () { qs.parse('a[]=', throwOptions); }, error, label + ': throws on an empty-string element');
+                sst['throws'](function () { qs.parse({ 'a[]': 'b' }, throwOptions); }, error, label + ': throws on a bracket key in object input');
+            });
+
+            sst.end();
+        });
+
+        st.test('zero and negative arrayLimit with comma', function (sst) {
+            forEach([0, -1], function (arrayLimit) {
+                var options = { arrayLimit: arrayLimit, comma: true };
+                var throwOptions = { arrayLimit: arrayLimit, comma: true, throwOnLimitExceeded: true };
+                var label = 'arrayLimit ' + arrayLimit;
+
+                sst.deepEqual(qs.parse('a=b', options), { a: 'b' }, label + ': a value without commas is unaffected');
+                sst.deepEqual(qs.parse('a=b,c', options), { a: { 0: 'b', 1: 'c' } }, label + ': a comma value becomes an object');
+                sst.deepEqual(qs.parse('a[]=b,c', options), { a: { 0: ['b', 'c'] } }, label + ': a bracket array holding a comma group becomes an object');
+                sst.deepEqual(qs.parse('a[0]=b,c', options), { a: { 0: { 0: 'b', 1: 'c' } } }, label + ': an indexed comma group becomes an object');
+
+                var error = arrayLimit === 0
+                    ? new RangeError('Array limit exceeded. Only 0 elements allowed in an array.')
+                    : RangeError;
+                sst['throws'](function () { qs.parse('a=b,c', throwOptions); }, error, label + ': throws on a comma value');
+                sst['throws'](function () { qs.parse('a[]=b,c', throwOptions); }, error, label + ': throws on a comma group under `[]=`');
+                sst['throws'](function () { qs.parse('a[0]=b,c', throwOptions); }, error, label + ': throws on an indexed comma group');
+            });
+
+            sst.end();
+        });
+
         st.test('converts array to object if length is greater than limit', function (sst) {
             var result = qs.parse('a[1]=1&a[2]=2&a[3]=3&a[4]=4&a[5]=5&a[6]=6', { arrayLimit: 5 });
 
@@ -1564,6 +1847,27 @@ test('parse()', function (t) {
             sst.end();
         });
 
+        st.test('counts the elements of a sparse indexed array on merge, not its holes', function (sst) {
+            sst.deepEqual(qs.parse('a[]=new&a[19]=19&a[0]=0'), { a: ['new', '19', '0'] }, 'an array merged into a sparse array');
+            sst.deepEqual(qs.parse('a[]=new&a[19]=19&a[0]=0', { throwOnLimitExceeded: true }), { a: ['new', '19', '0'] }, 'and it does not throw');
+            sst.deepEqual(qs.parse('a[0]=w&a[19]=x&a[]=y'), { a: ['w', 'x', 'y'] }, 'a bracket value appended after a high index');
+            sst.deepEqual(qs.parse('a[19]=x&a=y'), { a: ['x', 'y'] }, 'a scalar merged into a sparse array');
+            sst.deepEqual(qs.parse('a[19]=x&a=y', { throwOnLimitExceeded: true }), { a: ['x', 'y'] }, 'and it does not throw');
+
+            sst.deepEqual(
+                qs.parse('a[1]=x&a[]=y&a[]=z', { arrayLimit: 2 }),
+                { a: { 0: 'y', 1: 'x', 2: 'z' } },
+                'more elements than arrayLimit still converts when the array has holes'
+            );
+            sst['throws'](
+                function () { qs.parse('a[1]=x&a[]=y&a[]=z', { arrayLimit: 2, throwOnLimitExceeded: true }); },
+                new RangeError('Array limit exceeded. Only 2 elements allowed in an array.'),
+                'and throws with throwOnLimitExceeded'
+            );
+
+            sst.end();
+        });
+
         st.test('enforces arrayLimit when a strictMerge conflict appends to its container', function (sst) {
             var aliased = 'a[z]=o&a=p&a[y]=q&[a]=r';
             sst['throws'](
@@ -1621,6 +1925,35 @@ test('parse()', function (t) {
             sst.end();
         });
 
+        st.test('throws when a comma array at arrayLimit is combined with one more value', function (sst) {
+            var error = new RangeError('Array limit exceeded. Only 2 elements allowed in an array.');
+            sst['throws'](
+                function () { qs.parse('a=x,y&a=z', { comma: true, arrayLimit: 2, throwOnLimitExceeded: true }); },
+                error,
+                'a plain value appended to a full comma array'
+            );
+            sst['throws'](
+                function () { qs.parse('a=x&a=y,z', { comma: true, arrayLimit: 2, throwOnLimitExceeded: true }); },
+                error,
+                'a comma value appended to a plain value'
+            );
+            sst.end();
+        });
+
+        st.test('does not throw when a duplicate of a full comma array is discarded or replaces it', function (sst) {
+            sst.deepEqual(
+                qs.parse('a=x,y&a=z', { comma: true, arrayLimit: 2, throwOnLimitExceeded: true, duplicates: 'first' }),
+                { a: ['x', 'y'] },
+                'duplicates: first keeps the full array'
+            );
+            sst.deepEqual(
+                qs.parse('a=x,y&a=z', { comma: true, arrayLimit: 2, throwOnLimitExceeded: true, duplicates: 'last' }),
+                { a: 'z' },
+                'duplicates: last replaces the full array'
+            );
+            sst.end();
+        });
+
         st.test('silently combines to an overflow object when throwOnLimitExceeded is not set', function (sst) {
             var result = qs.parse('a=1,2,3&a=4,5,6', { comma: true, arrayLimit: 5 });
             sst.deepEqual(result, { a: { 0: '1', 1: '2', 2: '3', 3: '4', 4: '5', 5: '6' } }, 'converts to object without throwing');