@sap/cds-dk 10.1.2 → 10.2.1

package/node_modules/qs/test/parse.js

@@ -1,6 +1,7 @@
 'use strict';
 
 var test = require('tape');
+var forEach = require('for-each');
 var hasPropertyDescriptors = require('has-property-descriptors')();
 var iconv = require('iconv-lite');
 var mockProperty = require('mock-property');
@@ -62,10 +63,54 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('comma: `[]=` in a value does not wrap the value in an extra array', function (st) {
+        st.deepEqual(qs.parse('a[b]=1,2,3[]=x', { comma: true }), { a: { b: ['1', '2', '3[]=x'] } });
+        st.deepEqual(qs.parse('a[b]=1,2[]=3', { comma: true }), { a: { b: ['1', '2[]=3'] } });
+        st.deepEqual(qs.parse('a[]=1,2,3', { comma: true }), { a: [['1', '2', '3']] });
+        st.end();
+    });
+
     t.test('allows enabling dot notation', function (st) {
         st.deepEqual(qs.parse('a.b=c'), { 'a.b': 'c' });
         st.deepEqual(qs.parse('a.b=c', { allowDots: true }), { a: { b: 'c' } });
 
+        // a literal dot inside a bracket segment must not be rewritten by allowDots (#617)
+        st.deepEqual(
+            qs.parse('outer[a.b]=1', { allowDots: true }),
+            { outer: { 'a.b': '1' } },
+            'a dot inside brackets stays part of the key when allowDots is true'
+        );
+        st.deepEqual(
+            qs.parse('outer[a.b]=1', { allowDots: true }),
+            qs.parse('outer[a.b]=1', { allowDots: false }),
+            'allowDots does not change how a bracket segment containing a dot is parsed'
+        );
+        st.deepEqual(
+            qs.parse('a].b=c', { allowDots: true }),
+            { 'a]': { b: 'c' } },
+            'a stray close bracket does not stop a later dot from being converted'
+        );
+        st.deepEqual(
+            qs.parse('a]].b[c.d]=e', { allowDots: true }),
+            { 'a]]': { b: { 'c.d': 'e' } } },
+            'stray close brackets do not unbalance a later bracket segment'
+        );
+
+        st.end();
+    });
+
+    t.test('decode dot keys with case-insensitive percent escapes', function (st) {
+        var input = 'name%252eobj.first%252ename=John&name%252Eobj.last%252Ename=Doe';
+        st.deepEqual(
+            qs.parse(input, { decodeDotInKeys: true }),
+            { 'name.obj': { 'first.name': 'John', 'last.name': 'Doe' } },
+            'lowercase and uppercase escapes decode in both parent and child keys'
+        );
+        st.deepEqual(
+            qs.parse(input, { allowDots: true, decodeDotInKeys: false }),
+            { 'name%2eobj': { 'first%2ename': 'John' }, 'name%2Eobj': { 'last%2Ename': 'Doe' } },
+            'escaped dots remain unchanged when decoding is disabled'
+        );
         st.end();
     });
 
@@ -229,8 +274,34 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('ignores bracket-wrapped prototype keys when depth = 0 and allowPrototypes is false', function (st) {
+        st.deepEqual(qs.parse('[toString]=foo', { depth: 0 }), {}, 'the stored key is the bracket content');
+        st.deepEqual(qs.parse('[hasOwnProperty]=bar', { depth: 0 }), {});
+        st.deepEqual(qs.parse('%5BhasOwnProperty%5D=bar', { depth: 0 }), {}, 'percent-encoded brackets');
+        st.deepEqual(qs.parse('[toString]=foo&a=b', { depth: 0 }), { a: 'b' });
+        st.deepEqual(qs.parse('[toString]=foo', { depth: false }), {}, 'depth: false');
+        st.deepEqual(qs.parse('.toString=foo', { depth: 0, allowDots: true }), {}, 'a leading dot becomes a bracket group');
+        st.deepEqual(qs.parse('[a]=b&[toString]=foo', { depth: 0 }), { a: 'b' }, 'other bracket-wrapped keys still strip their brackets');
+        st.end();
+    });
+
     t.test('allows prototype keys when depth = 0 and allowPrototypes is true', function (st) {
         st.deepEqual(qs.parse('toString=foo', { depth: 0, allowPrototypes: true }), { toString: 'foo' });
+        st.deepEqual(qs.parse('[toString]=foo', { depth: 0, allowPrototypes: true }), { toString: 'foo' });
+        st.end();
+    });
+
+    t.test('keeps bracket-wrapped prototype keys when depth = 0 and plainObjects is true', function (st) {
+        var result = qs.parse('[toString]=foo', { depth: 0, plainObjects: true });
+        st.deepEqual(result, { __proto__: null, toString: 'foo' });
+        st.equal(Object.getPrototypeOf(result), null);
+        st.end();
+    });
+
+    t.test('strips one wrapping bracket pair from the key when depth = 0', function (st) {
+        st.deepEqual(qs.parse('[a]=b', { depth: 0 }), { a: 'b' });
+        st.deepEqual(qs.parse('[[toString]]=foo', { depth: 0 }), { '[toString]': 'foo' }, 'only the outer pair is stripped');
+        st.deepEqual(qs.parse('x[toString]=foo', { depth: 0 }), { 'x[toString]': 'foo' }, 'a key with a parent stays literal');
         st.end();
     });
 
@@ -360,6 +431,14 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('currently moves the key/value split to a later `]=` when the first `=` comes before any bracket group', function (st) {
+        characterizeParse(st, 'a=b[c]=d', undefined, { 'a=b': { c: 'd' } }, 'literal brackets after the first `=`');
+        characterizeParse(st, 'q=%5B1%5D=2', undefined, { 'q=': ['2'] }, 'encoded brackets collapse to an array');
+        characterizeParse(st, 'role=guest%5Bx%5Dy%5D=z', undefined, { 'role=guest': { x: 'z' } }, 'group opens after the first `=`, and the text after it is dropped');
+        characterizeParse(st, 'role=guest%5D=admin', undefined, { 'role=guest]': 'admin' }, 'encoded `]=` with no bracket group at all');
+        st.end();
+    });
+
     t.test('allows to specify array indices', function (st) {
         st.deepEqual(qs.parse('a[1]=c&a[0]=b&a[2]=d'), { a: ['b', 'c', 'd'] });
         st.deepEqual(qs.parse('a[1]=c&a[0]=b'), { a: ['b', 'c'] });
@@ -745,6 +824,38 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('does not mutate an object input', function (st) {
+        var arr = ['x'];
+        st.deepEqual(qs.parse({ a: arr, 'a[]': 'y' }), { a: ['x', 'y'] }, 'appends to a copy of an input array');
+        st.deepEqual(arr, ['x'], 'the input array is unchanged');
+
+        var nested = { b: ['x'] };
+        st.deepEqual(qs.parse({ a: nested, 'a[b][]': 'y' }), { a: { b: ['x', 'y'] } }, 'appends to a copy of a nested input array');
+        st.deepEqual(nested, { b: ['x'] }, 'the nested input array is unchanged');
+
+        var obj = { b: 'c' };
+        st.deepEqual(qs.parse({ a: obj, 'a[d]': 'e' }), { a: { b: 'c', d: 'e' } }, 'merges into a copy of an input object');
+        st.deepEqual(obj, { b: 'c' }, 'the input object is unchanged');
+
+        var sparse = { b: [1, undefined, 2] };
+        st.deepEqual(qs.parse({ a: sparse }), { a: { b: [1, 2] } }, 'compacts a copy of an input array');
+        st.deepEqual(sparse, { b: [1, undefined, 2] }, 'the input array is not compacted');
+
+        var nullProto = { __proto__: null, b: 'c' };
+        st.equal(Object.getPrototypeOf(qs.parse({ a: nullProto }).a), null, 'a null-prototype input object stays null-prototype');
+
+        var date = new Date(0);
+        st.equal(qs.parse({ a: date }).a, date, 'a non-plain object is not copied');
+
+        var cyclic = { b: 'c' };
+        cyclic.self = cyclic;
+        var result = qs.parse({ a: cyclic });
+        st.notEqual(result.a, cyclic, 'a cyclic input object is copied');
+        st.equal(result.a.self, result.a, 'the copy keeps the cycle');
+
+        st.end();
+    });
+
     t.test('does not blow up when Buffer global is missing', function (st) {
         var restore = mockProperty(global, 'Buffer', { 'delete': true });
 
@@ -962,6 +1073,38 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('strictMerge conflicts do not overwrite indexed values already at that path', function (st) {
+        st.deepEqual(
+            qs.parse('a[z]=o&a=p&a[y]=q&a[2]=keep&[a]=r'),
+            { a: { 0: { z: 'o' }, 1: 'p', 2: 'keep', 3: 'r', y: 'q' } },
+            'an indexed key merged into the container is kept'
+        );
+
+        st.deepEqual(
+            qs.parse('a[z]=o&a=p&a[2]=keep&a[y]=q&[a]=r'),
+            { a: { 0: { z: 'o' }, 1: 'p', 2: 'keep', 3: 'r', y: 'q' } },
+            'an indexed key that extended the container while it was an array is kept'
+        );
+
+        st.end();
+    });
+
+    t.test('strictMerge conflicts do not overwrite values once the container overflows', function (st) {
+        st.deepEqual(
+            qs.parse('a[z]=v0&a=v1&a[y]=v2&[a]=v3&[a]x=v4&a[2]=v5&[a]x1=v6', { arrayLimit: 2 }),
+            { a: { 0: { z: 'v0' }, 1: 'v1', 2: ['v3', 'v5'], 3: 'v4', 4: 'v6', y: 'v2' } },
+            'a conflict appended after the container overflowed keeps every value'
+        );
+
+        st.deepEqual(
+            qs.parse('a[2]=v1&a=v5&a=v7&[a]x=v9', { parseArrays: false, arrayLimit: 1 }),
+            { a: { 0: 'v5', 1: 'v7', 2: 'v1', 3: 'v9' } },
+            'an index the container already holds is not reused'
+        );
+
+        st.end();
+    });
+
     t.test('dunder proto is ignored', function (st) {
         var payload = 'categories[__proto__]=login&categories[__proto__]&categories[length]=42';
         var result = qs.parse(payload, { allowPrototypes: true });
@@ -1038,6 +1181,67 @@ test('parse()', function (t) {
         st.end();
     });
 
+    var withOwnProto = function (value) {
+        var obj = {};
+        Object.defineProperty(obj, '__proto__', {
+            configurable: true,
+            enumerable: true,
+            value: value,
+            writable: true
+        });
+        return obj;
+    };
+    // node < 0.12 reads an own `__proto__` data property as `Object.prototype`, so it can not be copied by value
+    var ownProtoIsReadable = withOwnProto(1).__proto__ === 1; // eslint-disable-line no-proto
+
+    t.test('object-valued input with only an own `__proto__` does not mutate sub-object [[Prototype]]', function (st) {
+        // `JSON.parse` in node < 0.12 sets the [[Prototype]] instead of creating an own `__proto__`
+        var out = qs.parse({ user: withOwnProto({ isAdmin: true }) });
+
+        st.equal(out.user.isAdmin, undefined, 'attacker-controlled inherited property is not exposed');
+        st.equal(Object.getPrototypeOf(out.user), Object.prototype, 'sub-object [[Prototype]] is unchanged');
+        st.equal(Object.prototype.isAdmin, undefined, 'Object.prototype is not polluted');
+
+        var sibling = withOwnProto({ isAdmin: true });
+        sibling.name = 'alice';
+        var withSibling = qs.parse({ user: sibling });
+
+        st.equal(withSibling.user.name, 'alice', 'sibling key is preserved');
+        st.equal(withSibling.user.isAdmin, undefined, 'a sibling key does not hide an inherited property');
+        st.equal(Object.getPrototypeOf(withSibling.user), Object.prototype, 'a sibling key does not change [[Prototype]]');
+
+        st.end();
+    });
+
+    t.test('object-valued input keeps an own `__proto__` as a data property', { skip: !ownProtoIsReadable }, function (st) {
+        var descriptor = function (value) {
+            return {
+                configurable: true,
+                enumerable: true,
+                value: value,
+                writable: true
+            };
+        };
+
+        st.deepEqual(
+            Object.getOwnPropertyDescriptor(qs.parse({ user: withOwnProto({ isAdmin: true }) }).user, '__proto__'),
+            descriptor({ isAdmin: true }),
+            'an object value is stored as a data property'
+        );
+        st.deepEqual(
+            Object.getOwnPropertyDescriptor(qs.parse({ user: withOwnProto('admin') }).user, '__proto__'),
+            descriptor('admin'),
+            'a primitive value is stored as a data property'
+        );
+        st.deepEqual(
+            Object.getOwnPropertyDescriptor(qs.parse({ 'user[name]': 'alice', user: withOwnProto({ isAdmin: true }) }).user, '__proto__'),
+            descriptor({ isAdmin: true }),
+            'it survives a merge with a bracket key'
+        );
+
+        st.end();
+    });
+
     t.test('can return null objects', { skip: !hasProto }, function (st) {
         var expected = {
             __proto__: null,
@@ -1061,6 +1265,19 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('returns null objects for empty brackets when parseArrays is false', { skip: !hasProto }, function (st) {
+        st.deepEqual(
+            qs.parse('a[]=b', { parseArrays: false, plainObjects: true }),
+            { __proto__: null, a: { __proto__: null, 0: 'b' } }
+        );
+        st.deepEqual(
+            qs.parse('a[]=b&a[hasOwnProperty]=c', { parseArrays: false, plainObjects: true }),
+            { __proto__: null, a: { __proto__: null, 0: 'b', hasOwnProperty: 'c' } },
+            'prototype keys land on a null object'
+        );
+        st.end();
+    });
+
     t.test('can parse with custom encoding', function (st) {
         st.deepEqual(qs.parse('%8c%a7=%91%e5%8d%e3%95%7b', {
             decoder: function (str) {
@@ -1153,6 +1370,31 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('interprets numeric entities above U+FFFF as surrogate pairs', function (st) {
+        var options = { charset: 'iso-8859-1', interpretNumericEntities: true };
+        st.deepEqual(qs.parse('foo=%26%23128512%3B', options), { foo: '\uD83D\uDE00' }, 'U+1F600, which a browser submits as `&#128512;` from an iso-8859-1 form');
+        st.deepEqual(qs.parse('foo=%26%2365536%3B', options), { foo: '\uD800\uDC00' }, 'U+10000');
+        st.deepEqual(qs.parse('foo=%26%231114111%3B', options), { foo: '\uDBFF\uDFFF' }, 'U+10FFFF');
+        st.deepEqual(qs.parse('foo=%26%2365535%3B', options), { foo: '\uFFFF' }, 'U+FFFF is still one code unit');
+        st.end();
+    });
+
+    t.test('interprets numeric entities in each value, but not in keys', function (st) {
+        var options = { charset: 'iso-8859-1', interpretNumericEntities: true };
+        st.deepEqual(qs.parse('a=' + urlEncodedNumSmiley + ',x', options), { a: '☺,x' }, 'a value with commas stays one string without `comma`');
+        st.deepEqual(qs.parse('a' + urlEncodedNumSmiley + '=x', options), { 'a&#9786;': 'x' }, 'keys are not interpreted');
+        st.deepEqual(qs.parse('a[]=' + urlEncodedNumSmiley + '&a[]=x', options), { a: ['☺', 'x'] }, 'bracket array values');
+        st.deepEqual(qs.parse('a=' + urlEncodedNumSmiley + '&a=x', options), { a: ['☺', 'x'] }, 'repeated key values');
+        st.deepEqual(qs.parse('a[b]=' + urlEncodedNumSmiley, options), { a: { b: '☺' } }, 'nested key values');
+        st.deepEqual(
+            qs.parse('utf8=%26%2310003%3B&a=' + urlEncodedNumSmiley, { charsetSentinel: true, interpretNumericEntities: true }),
+            { a: '☺' },
+            'an iso-8859-1 charset sentinel enables interpretation'
+        );
+        st.deepEqual(qs.parse('a=' + urlEncodedNumSmiley + ',x', { charset: 'iso-8859-1', comma: true }), { a: ['&#9786;', 'x'] }, '`comma` splits without `interpretNumericEntities`');
+        st.end();
+    });
+
     t.test('handles a custom decoder returning `null`, in the `iso-8859-1` charset, when `interpretNumericEntities`', function (st) {
         st.deepEqual(qs.parse('foo=&bar=' + urlEncodedNumSmiley, {
             charset: 'iso-8859-1',
@@ -1188,15 +1430,70 @@ test('parse()', function (t) {
         st.end();
     });
 
-    t.test('interpretNumericEntities with comma:true and iso charset does not crash', function (st) {
+    t.test('interpretNumericEntities preserves comma arrays in iso charset', function (st) {
         st.deepEqual(
             qs.parse('b&a[]=1,' + urlEncodedNumSmiley, { comma: true, charset: 'iso-8859-1', interpretNumericEntities: true }),
-            { b: '', a: ['1,☺'] }
+            { b: '', a: [['1', '☺']] }
         );
 
         st.end();
     });
 
+    t.test('interprets numeric entities per comma-separated value', function (st) {
+        var options = { comma: true, charset: 'iso-8859-1', interpretNumericEntities: true };
+        st.deepEqual(qs.parse('a=b,c', options), { a: ['b', 'c'] });
+        st.deepEqual(qs.parse('a=' + urlEncodedNumSmiley + ',%26%239786%3B', options), { a: ['☺', '☺'] });
+        st.deepEqual(qs.parse('a=%26%2344%3B,b%2Cc', options), { a: [',', 'b,c'] });
+        st.deepEqual(qs.parse('a=,b,', options), { a: ['', 'b', ''] });
+        st.deepEqual(qs.parse('a=b,c&a=d,e', options), { a: ['b', 'c', 'd', 'e'] });
+        st.deepEqual(qs.parse('a[]=b,c&a[]=d,e', options), { a: [['b', 'c'], ['d', 'e']] });
+        st.deepEqual(qs.parse('a[0]=b,c', options), { a: [['b', 'c']] });
+        st.deepEqual(qs.parse('utf8=%26%2310003%3B&a=b,' + urlEncodedNumSmiley, {
+            comma: true,
+            charsetSentinel: true,
+            interpretNumericEntities: true
+        }), { a: ['b', '☺'] });
+        st.deepEqual(qs.parse('a=b,c,d', {
+            comma: true,
+            charset: 'iso-8859-1',
+            interpretNumericEntities: true,
+            arrayLimit: 2
+        }), { a: { 0: 'b', 1: 'c', 2: 'd' } });
+        st['throws'](function () {
+            qs.parse('a=b,c,d', {
+                comma: true,
+                charset: 'iso-8859-1',
+                interpretNumericEntities: true,
+                arrayLimit: 2,
+                throwOnLimitExceeded: true
+            });
+        }, RangeError);
+        st.end();
+    });
+
+    t.test('preserves falsy decoder results inside comma arrays', function (st) {
+        st.deepEqual(qs.parse('a=null,0,false,' + urlEncodedNumSmiley, {
+            comma: true,
+            charset: 'iso-8859-1',
+            interpretNumericEntities: true,
+            decoder: function (str, defaultDecoder, charset, type) {
+                if (type === 'value') {
+                    if (str === 'null') {
+                        return null;
+                    }
+                    if (str === '0') {
+                        return 0;
+                    }
+                    if (str === 'false') {
+                        return false;
+                    }
+                }
+                return defaultDecoder(str, defaultDecoder, charset, type);
+            }
+        }), { a: [null, 0, false, '☺'] });
+        st.end();
+    });
+
     t.test('does not interpret %uXXXX syntax in iso-8859-1 mode', function (st) {
         st.deepEqual(qs.parse('%u263A=%u263A', { charset: 'iso-8859-1' }), { '%u263A': '%u263A' });
         st.end();
@@ -1320,6 +1617,41 @@ test('parse()', function (t) {
             sst.end();
         });
 
+        st.test('zero and negative arrayLimit allow non-array values', function (sst) {
+            forEach([0, -1], function (arrayLimit) {
+                var options = { arrayLimit: arrayLimit, throwOnLimitExceeded: true };
+                var label = 'arrayLimit ' + arrayLimit;
+                sst.deepEqual(qs.parse('a=b&c[d]=e', options), { a: 'b', c: { d: 'e' } }, label + ': query string fields');
+                sst.deepEqual(qs.parse('a=b', { arrayLimit: arrayLimit, throwOnLimitExceeded: true, comma: true }), { a: 'b' }, label + ': a value without commas when comma is enabled');
+                sst.deepEqual(qs.parse({ a: 'b', 'c[d]': 'e' }, options), { a: 'b', c: { d: 'e' } }, label + ': object input fields');
+                sst.deepEqual(qs.parse({ a: [] }, options), { a: [] }, label + ': an empty input array has no elements');
+                sst.deepEqual(
+                    qs.parse('a=b&a=c', { arrayLimit: arrayLimit, throwOnLimitExceeded: true, duplicates: 'last' }),
+                    { a: 'c' },
+                    label + ': replacing a duplicate does not create an array'
+                );
+                sst.deepEqual(
+                    qs.parse('a[]=', { arrayLimit: arrayLimit, throwOnLimitExceeded: true, allowEmptyArrays: true }),
+                    { a: [] },
+                    label + ': an empty array has no elements to exceed the limit'
+                );
+                sst.deepEqual(qs.parse({ a: ['b'] }, options), { a: ['b'] }, label + ': an array value in object input is left as-is');
+                sst.deepEqual(qs.parse({ 'a[b]': ['x'] }, options), { a: { b: ['x'] } }, label + ': an array value under a nested key in object input is left as-is');
+                sst.deepEqual(qs.parse('a.b=c', { arrayLimit: arrayLimit, throwOnLimitExceeded: true, allowDots: true }), { a: { b: 'c' } }, label + ': dotted keys');
+                sst.deepEqual(
+                    qs.parse('a=b&a=c', { arrayLimit: arrayLimit, throwOnLimitExceeded: true, duplicates: 'first' }),
+                    { a: 'b' },
+                    label + ': keeping the first duplicate does not create an array'
+                );
+                sst.deepEqual(
+                    qs.parse('a[]=b', { arrayLimit: arrayLimit, throwOnLimitExceeded: true, parseArrays: false }),
+                    { a: { 0: 'b' } },
+                    label + ': array syntax with parseArrays false does not create an array'
+                );
+            });
+            sst.end();
+        });
+
         st.test('does not throw when at limit', function (sst) {
             // 3 elements = limit of 3, should not throw
             var result = qs.parse('a[]=1&a[]=2&a[]=3', { arrayLimit: 3, throwOnLimitExceeded: true });
@@ -1328,6 +1660,58 @@ test('parse()', function (t) {
             sst.end();
         });
 
+        st.test('zero and negative arrayLimit', function (sst) {
+            forEach([0, -1], function (arrayLimit) {
+                var options = { arrayLimit: arrayLimit };
+                var throwOptions = { arrayLimit: arrayLimit, throwOnLimitExceeded: true };
+                var label = 'arrayLimit ' + arrayLimit;
+
+                sst.deepEqual(qs.parse('a=b&c[d]=e', options), { a: 'b', c: { d: 'e' } }, label + ': scalar and object fields are unaffected');
+                sst.deepEqual(qs.parse('a[]=b', options), { a: { 0: 'b' } }, label + ': a bracket array becomes an object');
+                sst.deepEqual(qs.parse('a[]=b&a[]=c', options), { a: { 0: 'b', 1: 'c' } }, label + ': a multi-element bracket array becomes an object');
+                sst.deepEqual(qs.parse('a[0]=b', options), { a: { 0: 'b' } }, label + ': an indexed array becomes an object');
+                sst.deepEqual(qs.parse('a=b&a=c', options), { a: { 0: 'b', 1: 'c' } }, label + ': combined duplicates become an object');
+                sst.deepEqual(qs.parse('a[]=', options), { a: { 0: '' } }, label + ': an empty-string element still counts as an element');
+                sst.deepEqual(qs.parse('a[]=', { arrayLimit: arrayLimit, allowEmptyArrays: true }), { a: [] }, label + ': an empty array has no elements');
+                sst.deepEqual(qs.parse({ 'a[]': 'b' }, options), { a: { 0: 'b' } }, label + ': a bracket key in object input becomes an object');
+                sst.deepEqual(qs.parse({ a: ['b'] }, options), { a: ['b'] }, label + ': an array value in object input is left as-is');
+                sst.deepEqual(qs.parse({ a: [] }, options), { a: [] }, label + ': an empty array value in object input is left as-is');
+
+                var error = arrayLimit === 0
+                    ? new RangeError('Array limit exceeded. Only 0 elements allowed in an array.')
+                    : RangeError;
+                sst['throws'](function () { qs.parse('a[]=b', throwOptions); }, error, label + ': throws on a bracket array');
+                sst['throws'](function () { qs.parse('a[0]=b', throwOptions); }, error, label + ': throws on an indexed array');
+                sst['throws'](function () { qs.parse('a=b&a=c', throwOptions); }, error, label + ': throws on combined duplicates');
+                sst['throws'](function () { qs.parse('a[]=', throwOptions); }, error, label + ': throws on an empty-string element');
+                sst['throws'](function () { qs.parse({ 'a[]': 'b' }, throwOptions); }, error, label + ': throws on a bracket key in object input');
+            });
+
+            sst.end();
+        });
+
+        st.test('zero and negative arrayLimit with comma', function (sst) {
+            forEach([0, -1], function (arrayLimit) {
+                var options = { arrayLimit: arrayLimit, comma: true };
+                var throwOptions = { arrayLimit: arrayLimit, comma: true, throwOnLimitExceeded: true };
+                var label = 'arrayLimit ' + arrayLimit;
+
+                sst.deepEqual(qs.parse('a=b', options), { a: 'b' }, label + ': a value without commas is unaffected');
+                sst.deepEqual(qs.parse('a=b,c', options), { a: { 0: 'b', 1: 'c' } }, label + ': a comma value becomes an object');
+                sst.deepEqual(qs.parse('a[]=b,c', options), { a: { 0: ['b', 'c'] } }, label + ': a bracket array holding a comma group becomes an object');
+                sst.deepEqual(qs.parse('a[0]=b,c', options), { a: { 0: { 0: 'b', 1: 'c' } } }, label + ': an indexed comma group becomes an object');
+
+                var error = arrayLimit === 0
+                    ? new RangeError('Array limit exceeded. Only 0 elements allowed in an array.')
+                    : RangeError;
+                sst['throws'](function () { qs.parse('a=b,c', throwOptions); }, error, label + ': throws on a comma value');
+                sst['throws'](function () { qs.parse('a[]=b,c', throwOptions); }, error, label + ': throws on a comma group under `[]=`');
+                sst['throws'](function () { qs.parse('a[0]=b,c', throwOptions); }, error, label + ': throws on an indexed comma group');
+            });
+
+            sst.end();
+        });
+
         st.test('converts array to object if length is greater than limit', function (sst) {
             var result = qs.parse('a[1]=1&a[2]=2&a[3]=3&a[4]=4&a[5]=5&a[6]=6', { arrayLimit: 5 });
 
@@ -1463,12 +1847,113 @@ test('parse()', function (t) {
             sst.end();
         });
 
+        st.test('counts the elements of a sparse indexed array on merge, not its holes', function (sst) {
+            sst.deepEqual(qs.parse('a[]=new&a[19]=19&a[0]=0'), { a: ['new', '19', '0'] }, 'an array merged into a sparse array');
+            sst.deepEqual(qs.parse('a[]=new&a[19]=19&a[0]=0', { throwOnLimitExceeded: true }), { a: ['new', '19', '0'] }, 'and it does not throw');
+            sst.deepEqual(qs.parse('a[0]=w&a[19]=x&a[]=y'), { a: ['w', 'x', 'y'] }, 'a bracket value appended after a high index');
+            sst.deepEqual(qs.parse('a[19]=x&a=y'), { a: ['x', 'y'] }, 'a scalar merged into a sparse array');
+            sst.deepEqual(qs.parse('a[19]=x&a=y', { throwOnLimitExceeded: true }), { a: ['x', 'y'] }, 'and it does not throw');
+
+            sst.deepEqual(
+                qs.parse('a[1]=x&a[]=y&a[]=z', { arrayLimit: 2 }),
+                { a: { 0: 'y', 1: 'x', 2: 'z' } },
+                'more elements than arrayLimit still converts when the array has holes'
+            );
+            sst['throws'](
+                function () { qs.parse('a[1]=x&a[]=y&a[]=z', { arrayLimit: 2, throwOnLimitExceeded: true }); },
+                new RangeError('Array limit exceeded. Only 2 elements allowed in an array.'),
+                'and throws with throwOnLimitExceeded'
+            );
+
+            sst.end();
+        });
+
+        st.test('enforces arrayLimit when a strictMerge conflict appends to its container', function (sst) {
+            var aliased = 'a[z]=o&a=p&a[y]=q&[a]=r';
+            sst['throws'](
+                function () { qs.parse(aliased, { arrayLimit: 2, throwOnLimitExceeded: true }); },
+                new RangeError('Array limit exceeded. Only 2 elements allowed in an array.'),
+                'a third conflicting value throws once the container would exceed arrayLimit'
+            );
+            sst.deepEqual(
+                qs.parse(aliased, { arrayLimit: 3, throwOnLimitExceeded: true }),
+                { a: { 0: { z: 'o' }, 1: 'p', 2: 'r', y: 'q' } },
+                'appends while the container stays within arrayLimit'
+            );
+            sst.deepEqual(
+                qs.parse(aliased, { arrayLimit: 2 }),
+                { a: { 0: { z: 'o' }, 1: 'p', 2: 'r', y: 'q' } },
+                'appends without throwing when throwOnLimitExceeded is not set'
+            );
+
+            sst.end();
+        });
+
+        st.test('enforces arrayLimit when differently spelled keys collide', function (sst) {
+            sst['throws'](
+                function () { qs.parse('[a]=x&a=y', { arrayLimit: 1, throwOnLimitExceeded: true }); },
+                new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
+                'two primitives throw, as `a=x&a=y` does'
+            );
+            sst['throws'](
+                function () { qs.parse('a[b]=x&a=y', { arrayLimit: 1, throwOnLimitExceeded: true }); },
+                new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
+                'an object and a primitive throw under strictMerge'
+            );
+            sst.deepEqual(
+                qs.parse('[a]=x&a=y', { arrayLimit: 1 }),
+                { a: { 0: 'x', 1: 'y' } },
+                'without throwOnLimitExceeded, two primitives convert to an object, as `a=x&a=y` does'
+            );
+            sst.deepEqual(
+                qs.parse('a[b]=x&a=y', { arrayLimit: 1 }),
+                { a: { 0: { b: 'x' }, 1: 'y' } },
+                'and so do an object and a primitive'
+            );
+            sst.deepEqual(
+                qs.parse('a[b]=x&a=y', { arrayLimit: 2, throwOnLimitExceeded: true }),
+                { a: [{ b: 'x' }, 'y'] },
+                'a collision within arrayLimit is still an array'
+            );
+
+            sst.end();
+        });
+
         st.test('does not throw when cumulative comma combine stays within arrayLimit', function (sst) {
             var result = qs.parse('a=1,2,3&a=4', { comma: true, arrayLimit: 5, throwOnLimitExceeded: true });
             sst.deepEqual(result, { a: ['1', '2', '3', '4'] }, 'combined array within limit is preserved');
             sst.end();
         });
 
+        st.test('throws when a comma array at arrayLimit is combined with one more value', function (sst) {
+            var error = new RangeError('Array limit exceeded. Only 2 elements allowed in an array.');
+            sst['throws'](
+                function () { qs.parse('a=x,y&a=z', { comma: true, arrayLimit: 2, throwOnLimitExceeded: true }); },
+                error,
+                'a plain value appended to a full comma array'
+            );
+            sst['throws'](
+                function () { qs.parse('a=x&a=y,z', { comma: true, arrayLimit: 2, throwOnLimitExceeded: true }); },
+                error,
+                'a comma value appended to a plain value'
+            );
+            sst.end();
+        });
+
+        st.test('does not throw when a duplicate of a full comma array is discarded or replaces it', function (sst) {
+            sst.deepEqual(
+                qs.parse('a=x,y&a=z', { comma: true, arrayLimit: 2, throwOnLimitExceeded: true, duplicates: 'first' }),
+                { a: ['x', 'y'] },
+                'duplicates: first keeps the full array'
+            );
+            sst.deepEqual(
+                qs.parse('a=x,y&a=z', { comma: true, arrayLimit: 2, throwOnLimitExceeded: true, duplicates: 'last' }),
+                { a: 'z' },
+                'duplicates: last replaces the full array'
+            );
+            sst.end();
+        });
+
         st.test('silently combines to an overflow object when throwOnLimitExceeded is not set', function (sst) {
             var result = qs.parse('a=1,2,3&a=4,5,6', { comma: true, arrayLimit: 5 });
             sst.deepEqual(result, { a: { 0: '1', 1: '2', 2: '3', 3: '4', 4: '5', 5: '6' } }, 'converts to object without throwing');
@@ -1807,6 +2292,28 @@ test('`duplicates` option', function (t) {
         st.end();
     });
 
+    t.test('`[]=` in a value does not force combining', function (st) {
+        st.deepEqual(
+            qs.parse('a[b]=1&a[b]=2[]=3', { duplicates: 'last' }),
+            { a: { b: '2[]=3' } },
+            'duplicates last: `[]=` in the value is not a bracketed key'
+        );
+
+        st.deepEqual(
+            qs.parse('a[b]=1&a[b]=2[]=3', { duplicates: 'first' }),
+            { a: { b: '1' } },
+            'duplicates first: `[]=` in the value is not a bracketed key'
+        );
+
+        st.deepEqual(
+            qs.parse('a[b]=1&a[b]=2[]=3', { duplicates: 'combine' }),
+            { a: { b: ['1', '2[]=3'] } },
+            'duplicates combine: still combines'
+        );
+
+        st.end();
+    });
+
     t.end();
 });