@sap/cds-dk 10.1.2 → 10.2.1

package/node_modules/qs/test/stringify.js

@@ -5,6 +5,7 @@ var qs = require('../');
 var utils = require('../lib/utils');
 var iconv = require('iconv-lite');
 var SaferBuffer = require('safer-buffer').Buffer;
+var url = require('url');
 var hasSymbols = require('has-symbols');
 var mockProperty = require('mock-property');
 var emptyTestCases = require('./empty-keys-cases').emptyTestCases;
@@ -24,6 +25,28 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('stringifies lone surrogates as U+FFFD', function (st) {
+        st.equal(qs.stringify({ a: '\uD800x' }), 'a=%EF%BF%BDx', 'lone high surrogate does not swallow the next character');
+        st.equal(qs.stringify({ a: '\uDC00x' }), 'a=%EF%BF%BDx', 'lone low surrogate does not swallow the next character');
+        st.equal(qs.stringify({ '\uD800': 'b' }), '%EF%BF%BD=b', 'lone surrogate in a key');
+        st.deepEqual(qs.parse(qs.stringify({ a: 'x\uD800y' })), { a: 'x\uFFFDy' }, 'parses back with U+FFFD in place of the lone surrogate');
+        st.equal(qs.stringify({ '\uDC00': 'b' }), '%EF%BF%BD=b', 'lone low surrogate in a key');
+        st.equal(qs.stringify({ a: { 'b\uD800': 'c' } }), 'a%5Bb%EF%BF%BD%5D=c', 'lone surrogate in a nested key does not swallow the closing bracket');
+        st.equal(qs.stringify({ a: '\uD800 x' }, { format: 'RFC1738' }), 'a=%EF%BF%BD+x', 'lone surrogate does not swallow a space in RFC1738');
+        st.equal(
+            qs.stringify({ 'a\uD800': { b: 'c' } }, { allowDots: true, encodeDotInKeys: true }),
+            'a%EF%BF%BD.b=c',
+            'lone surrogate does not swallow a dot separator'
+        );
+        st.equal(qs.stringify({ a: ['x\uD800', 'y'] }, { arrayFormat: 'comma' }), 'a=x%EF%BF%BD%2Cy', 'lone surrogate does not swallow a comma');
+        st.equal(
+            qs.stringify({ a: ['x\uD800', 'y'] }, { arrayFormat: 'comma', encodeValuesOnly: true }),
+            'a=x%EF%BF%BD,y',
+            'lone surrogate at the end of a comma-joined element encodes as U+FFFD'
+        );
+        st.end();
+    });
+
     t.test('stringifies falsy values', function (st) {
         st.equal(qs.stringify(undefined), '');
         st.equal(qs.stringify(null), '');
@@ -212,63 +235,94 @@ test('stringify()', function (t) {
         st.end();
     });
 
-    // Characterization of the CURRENT (buggy) behavior: with `allowDots` + `encodeDotInKeys`,
-    // `stringify` percent-encodes the structural `.` separators that `allowDots` inserts between
-    // nested keys, not just the literal dots inside a key, which breaks the stringify -> parse
-    // round-trip. These assertions pin that behavior so it cannot change silently: the fix in
-    // https://github.com/ljharb/qs/pull/564 changes every output below, so landing that fix MUST
-    // update this test (that is the point — it forces the behavior change to be explicit).
-    t.test('[characterization] encodeDotInKeys currently over-encodes structural separator dots (pre-#564)', function (st) {
+    t.test('does not encode the structural separator dots between nested keys when encodeDotInKeys and allowDots are provided', function (st) {
         st.equal(
-            qs.stringify({ a: { b: { c: 'd' } } }, { allowDots: true, encodeDotInKeys: true }),
-            'a%252Eb.c=d',
-            'over-encodes the a->b separator (#564: should become a.b.c=d)'
+            qs.stringify(
+                { a: { b: { c: 'd' } } },
+                { allowDots: true, encodeDotInKeys: true }
+            ),
+            'a.b.c=d',
+            'no key contains a literal dot, so encodeDotInKeys is a no-op on the separators'
         );
         st.equal(
-            qs.stringify({ a: { b: { c: { d: 'e' } } } }, { allowDots: true, encodeDotInKeys: true }),
-            'a%252Eb%252Ec.d=e',
-            'clobbers every separator but the last (#564: should become a.b.c.d=e)'
+            qs.stringify(
+                { a: { b: { c: { d: 'e' } } } },
+                { allowDots: true, encodeDotInKeys: true }
+            ),
+            'a.b.c.d=e',
+            'every nesting separator is preserved, not just the last one'
         );
-        st.equal(
-            qs.stringify({ 'a.b': { c: { d: 'e' } } }, { allowDots: true, encodeDotInKeys: true }),
-            'a%252Eb%252Ec.d=e',
-            'top-level dotted key: deeper separators also get encoded (#564: should become a%252Eb.c.d=e)'
+
+        st.deepEqual(
+            qs.parse(
+                qs.stringify({ a: { b: { c: 'd' } } }, { allowDots: true, encodeDotInKeys: true }),
+                { allowDots: true, decodeDotInKeys: true }
+            ),
+            { a: { b: { c: 'd' } } },
+            'stringify -> parse round-trips a deeply nested object'
         );
+
+        st.end();
+    });
+
+    t.test('encodeDotInKeys encodes only literal dots inside nested keys, never the structural separators, at any depth', function (st) {
         st.equal(
             qs.stringify({ a: { 'b.c': { d: 'e' } } }, { allowDots: true, encodeDotInKeys: true }),
-            'a%252Eb%252Ec.d=e',
-            'nested dotted key + object value: the separator around it is encoded (#564: should become a.b%252Ec.d=e)'
+            'a.b%252Ec.d=e',
+            'a nested key with a literal dot and an object value encodes only its own dot'
+        );
+        st.equal(
+            qs.stringify({ 'a.b': { c: { d: 'e' } } }, { allowDots: true, encodeDotInKeys: true }),
+            'a%252Eb.c.d=e',
+            'a top-level dotted key stays encoded while deeper separators stay literal'
         );
         st.equal(
             qs.stringify({ a: { b: { 'c.d': { e: 'f' } } } }, { allowDots: true, encodeDotInKeys: true }),
-            'a%252Eb%252Ec%252Ed.e=f',
-            'deeply nested dotted key: all separators encoded (#564: should become a.b.c%252Ed.e=f)'
+            'a.b.c%252Ed.e=f',
+            'a literal dot in a deeply nested key is encoded without touching the separators around it'
         );
 
         st.equal(
             qs.stringify({ a: { b: [1, 2] } }, { allowDots: true, encodeDotInKeys: true }),
-            'a%252Eb%5B0%5D=1&a%252Eb%5B1%5D=2',
-            'array value under nested keys: separator encoded (#564: should become a.b%5B0%5D=1&a.b%5B1%5D=2)'
+            'a.b%5B0%5D=1&a.b%5B1%5D=2',
+            'separator dots are preserved for an array value nested under keys'
         );
         st.equal(
             qs.stringify({ a: { 'b.c': [1, 2] } }, { allowDots: true, encodeDotInKeys: true }),
-            'a%252Eb%252Ec%5B0%5D=1&a%252Eb%252Ec%5B1%5D=2',
-            'array value under nested dotted key (#564: should become a.b%252Ec%5B0%5D=1&a.b%252Ec%5B1%5D=2)'
+            'a.b%252Ec%5B0%5D=1&a.b%252Ec%5B1%5D=2',
+            'a nested dotted key with an array value encodes only its own dot'
         );
 
-        st.equal(
-            qs.stringify({ a: { 'b.c': { d: 'e' } } }, { allowDots: false, encodeDotInKeys: true }),
-            'a%5Bb%252Ec%5D%5Bd%5D=e',
-            'allowDots:false object value encodes the nested-key dot, unlike the primitive-value case (#564: should become a%5Bb.c%5D%5Bd%5D=e)'
+        st.deepEqual(
+            qs.parse(
+                qs.stringify({ a: { 'b.c': { d: 'e' } } }, { allowDots: true, encodeDotInKeys: true }),
+                { allowDots: true, decodeDotInKeys: true }
+            ),
+            { a: { 'b.c': { d: 'e' } } },
+            'stringify -> parse round-trips a nested dotted key with an object value'
         );
-
         st.deepEqual(
             qs.parse(
-                qs.stringify({ a: { b: { c: 'd' } } }, { allowDots: true, encodeDotInKeys: true }),
+                qs.stringify({ 'a.b': { c: { d: 'e' } } }, { allowDots: true, encodeDotInKeys: true }),
                 { allowDots: true, decodeDotInKeys: true }
             ),
-            { 'a.b': { c: 'd' } },
-            'the over-encoding breaks the round-trip: {a:{b:{c}}} comes back as {"a.b":{c}} (#564 restores it)'
+            { 'a.b': { c: { d: 'e' } } },
+            'stringify -> parse round-trips a top-level dotted key with deep nesting'
+        );
+
+        st.end();
+    });
+
+    t.test('with allowDots false, encodeDotInKeys leaves nested-key dots literal, consistently for object and primitive values', function (st) {
+        st.equal(
+            qs.stringify({ a: { 'b.c': { d: 'e' } } }, { allowDots: false, encodeDotInKeys: true }),
+            'a%5Bb.c%5D%5Bd%5D=e',
+            'nested dotted key with an object value'
+        );
+        st.equal(
+            qs.stringify({ a: { 'b.c': 'e' } }, { allowDots: false, encodeDotInKeys: true }),
+            'a%5Bb.c%5D=e',
+            'nested dotted key with a primitive value matches the object-value case'
         );
 
         st.end();
@@ -394,6 +448,41 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('ignores inherited array format names', function (st) {
+        var array = { a: ['b', 'c'] };
+        var indices = 'a%5B0%5D=b&a%5B1%5D=c';
+        var repeat = 'a=b&a=c';
+
+        st.equal(qs.stringify(array, { arrayFormat: 'unsupported' }), indices, 'unknown format falls back to `indices`');
+
+        var names = [
+            'constructor',
+            'toString',
+            '__proto__',
+            'valueOf',
+            'hasOwnProperty',
+            'isPrototypeOf',
+            'propertyIsEnumerable',
+            'toLocaleString'
+        ];
+        for (var i = 0; i < names.length; i++) {
+            var name = names[i];
+            st.equal(qs.stringify(array, { arrayFormat: name }), indices, '`' + name + '` falls back to `indices`');
+            st.equal(
+                qs.stringify(array, { arrayFormat: name, indices: true }),
+                indices,
+                '`' + name + '` with `indices: true` falls back to `indices`'
+            );
+            st.equal(
+                qs.stringify(array, { arrayFormat: name, indices: false }),
+                repeat,
+                '`' + name + '` with `indices: false` falls back to `repeat`'
+            );
+        }
+
+        st.end();
+    });
+
     t.test('`skipNulls` option', function (st) {
         st.equal(
             qs.stringify({ a: 'b', c: null }, { skipNulls: true }),
@@ -454,6 +543,24 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('allowEmptyArrays keys that need no encoding', function (st) {
+        st.equal(qs.stringify({ foo: [] }, { allowEmptyArrays: true, format: 'RFC1738' }), 'foo[]', 'a top-level key in RFC1738');
+        st.equal(
+            qs.stringify({ a: { b: [] }, c: 'd e' }, { allowEmptyArrays: true, encodeValuesOnly: true }),
+            'a[b][]&c=d%20e',
+            'a nested key with encodeValuesOnly'
+        );
+        st.equal(qs.stringify({ a: { b: [] } }, { allowEmptyArrays: true, encode: false }), 'a[b][]', 'a nested key with encode: false');
+        st.equal(qs.stringify({ a: { b: [] } }, { allowEmptyArrays: true, allowDots: true }), 'a.b[]', 'a nested key with allowDots');
+        st.equal(
+            qs.stringify({ a: { b: [] } }, { allowEmptyArrays: true, allowDots: true, format: 'RFC1738' }),
+            'a.b[]',
+            'a nested key with allowDots in RFC1738'
+        );
+
+        st.end();
+    });
+
     t.test('allowEmptyArrays + strictNullHandling', function (st) {
         st.equal(
             qs.stringify(
@@ -499,6 +606,62 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('should encode the key of an empty array when allowEmptyArrays is set', function (st) {
+        st.equal(
+            qs.stringify({ 'a b': [] }, { allowEmptyArrays: true }),
+            'a%20b[]',
+            'default (RFC3986) percent-encodes the space in the key'
+        );
+        st.equal(
+            qs.stringify({ 'a b': [] }, { allowEmptyArrays: true, format: 'RFC1738' }),
+            'a+b[]',
+            'RFC1738 encodes the space in the key as a plus'
+        );
+        st.equal(
+            qs.stringify({ 'a b': [] }, { allowEmptyArrays: true, encodeValuesOnly: true }),
+            'a b[]',
+            'encodeValuesOnly leaves the key unencoded'
+        );
+        st.equal(
+            qs.stringify({ 'a b': [] }, { allowEmptyArrays: true, encode: false }),
+            'a b[]',
+            'encode: false leaves the key unencoded'
+        );
+
+        st.deepEqual(
+            qs.parse(qs.stringify({ 'a b': [], 'a&b=c': [] }, { allowEmptyArrays: true }), { allowEmptyArrays: true }),
+            { 'a b': [], 'a&b=c': [] },
+            'the encoded keys round-trip back to the original, including `&` and `=`'
+        );
+        st.equal(
+            qs.stringify({ 'a b': ['x'] }, { allowEmptyArrays: true, arrayFormat: 'brackets' }),
+            'a%20b%5B%5D=x',
+            'the same key with a value encodes the key prefix identically'
+        );
+        st.equal(
+            qs.stringify({ a: { 'b c': [] } }, { allowEmptyArrays: true }),
+            'a%5Bb%20c%5D[]',
+            'a nested key prefix is encoded like the value path encodes it'
+        );
+        st.equal(
+            qs.stringify({ a: { b: [] } }, { allowEmptyArrays: true }),
+            'a%5Bb%5D[]',
+            'a nested key that needs no encoding still has its brackets encoded'
+        );
+        st.equal(
+            qs.stringify({ 'a.b': [] }, { allowEmptyArrays: true, allowDots: true, encodeDotInKeys: true }),
+            'a%252Eb[]',
+            'encodeDotInKeys double-encodes the dot, as on the value path'
+        );
+        st.deepEqual(
+            qs.parse('a%252Eb[]', { allowEmptyArrays: true, allowDots: true, decodeDotInKeys: true }),
+            { 'a.b': [] },
+            'the encodeDotInKeys output round-trips'
+        );
+
+        st.end();
+    });
+
     t.test('stringifies an array value with one item vs multiple items', function (st) {
         st.test('non-array item', function (s2t) {
             s2t.equal(qs.stringify({ a: 'c' }, { encodeValuesOnly: true, arrayFormat: 'indices' }), 'a=c');
@@ -569,6 +732,53 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('encodes comma array values with the same encoder arguments as other values, with encodeValuesOnly', function (st) {
+        var commaValuesOnly = { arrayFormat: 'comma', encodeValuesOnly: true };
+
+        st.equal(
+            qs.stringify({ a: ['é', 'x'], b: 'é' }, utils.assign({ charset: 'iso-8859-1' }, commaValuesOnly)),
+            'a=%E9,x&b=%E9',
+            'respects charset iso-8859-1'
+        );
+        st.deepEqual(
+            qs.parse(qs.stringify({ a: ['é', 'x'] }, utils.assign({ charset: 'iso-8859-1' }, commaValuesOnly)), { charset: 'iso-8859-1', comma: true }),
+            { a: ['é', 'x'] },
+            'round-trips in iso-8859-1'
+        );
+        st.equal(
+            qs.stringify({ a: ['☺'] }, utils.assign({ charset: 'iso-8859-1' }, commaValuesOnly)),
+            'a=%26%239786%3B',
+            'encodes unrepresentable chars as numeric entities in iso-8859-1'
+        );
+        st.equal(
+            qs.stringify({ a: ['(x)', 'y z'], b: '(x)' }, utils.assign({ format: qs.formats.RFC1738 }, commaValuesOnly)),
+            'a=(x),y+z&b=(x)',
+            'respects format RFC1738'
+        );
+
+        var calls = [];
+        st.equal(
+            qs.stringify({ a: ['b', 'c'] }, utils.assign({
+                encoder: function (str, defaultEncoder, charset, kind, format) {
+                    calls[calls.length] = [str, typeof defaultEncoder, charset, kind, format];
+                    return defaultEncoder(str, defaultEncoder, charset, kind, format).toUpperCase();
+                }
+            }, commaValuesOnly)),
+            'a=B,C',
+            'a custom encoder can call defaultEncoder'
+        );
+        st.deepEqual(
+            calls,
+            [
+                ['b', 'function', 'utf-8', 'value', qs.formats.RFC3986],
+                ['c', 'function', 'utf-8', 'value', qs.formats.RFC3986]
+            ],
+            'a custom encoder receives defaultEncoder, charset, kind, and format'
+        );
+
+        st.end();
+    });
+
     t.test('stringifies comma and empty non-array values', function (st) {
         st.equal(qs.stringify({ a: ',', b: '', c: 'c,d%' }, { encode: false, arrayFormat: 'indices' }), 'a=,&b=&c=c,d%');
         st.equal(qs.stringify({ a: ',', b: '', c: 'c,d%' }, { encode: false, arrayFormat: 'brackets' }), 'a=,&b=&c=c,d%');
@@ -865,6 +1075,112 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('arrayFormat=comma: does not crash on entries with no callable `toString`', function (st) {
+        var json = JSON.parse('{ "a": ["b", { "toString": "x" }, "c"] }');
+        st.equal(qs.stringify(json, { arrayFormat: 'comma' }), 'a=b%2C%5Bobject%20Object%5D%2Cc', 'JSON own `toString`');
+        st.equal(qs.stringify(json, { arrayFormat: 'comma', encode: false }), 'a=b,[object Object],c', 'with encode: false');
+        st.equal(
+            qs.stringify(json, { arrayFormat: 'comma', encodeValuesOnly: true }),
+            'a=b,%5Bobject%20Object%5D,c',
+            'with encodeValuesOnly'
+        );
+        st.equal(
+            qs.stringify(JSON.parse('{ "a": [{ "toString": "x" }] }'), { arrayFormat: 'comma', commaRoundTrip: true }),
+            'a%5B%5D=%5Bobject%20Object%5D',
+            'with commaRoundTrip'
+        );
+        st.equal(
+            qs.stringify(JSON.parse('{ "a": [{ "toString": "x" }] }'), { arrayFormat: 'comma' }),
+            qs.stringify({ a: [{ b: 1 }] }, { arrayFormat: 'comma' }),
+            'renders the same as a plain object entry'
+        );
+
+        st.equal(
+            qs.stringify(qs.parse('a[][b]=c', { plainObjects: true }), { arrayFormat: 'comma' }),
+            'a=%5Bobject%20Object%5D',
+            'null-prototype entry from `parse` with plainObjects'
+        );
+        st.equal(
+            qs.stringify(qs.parse('a[][b]=c', { plainObjects: true }), { arrayFormat: 'comma', encodeValuesOnly: true }),
+            'a=%5Bobject%20Object%5D',
+            'null-prototype entry from `parse` with plainObjects, with encodeValuesOnly'
+        );
+        st.equal(
+            qs.stringify(qs.parse('a[0][toString]=x', { allowPrototypes: true }), { arrayFormat: 'comma' }),
+            'a=%5Bobject%20Object%5D',
+            'own `toString` entry from `parse` with allowPrototypes'
+        );
+
+        var nested = JSON.parse('{ "a": [[1, [{ "toString": "x" }]], "y"] }');
+        st.equal(qs.stringify(nested, { arrayFormat: 'comma', encode: false }), 'a=1,[object Object],y', 'nested array');
+        st.equal(
+            qs.stringify(nested, { arrayFormat: 'comma', encodeValuesOnly: true }),
+            'a=1%2C%5Bobject%20Object%5D,y',
+            'nested array, with encodeValuesOnly'
+        );
+        st.equal(qs.stringify({ a: [[1, 2], 3] }, { arrayFormat: 'comma', encode: false }), 'a=1,2,3', 'nested array is still flattened');
+
+        var cyclic = [{ toString: 'x' }];
+        cyclic[cyclic.length] = cyclic;
+        st.equal(
+            qs.stringify({ a: cyclic }, { arrayFormat: 'comma', encode: false }),
+            'a=[object Object],[object Object],',
+            'cyclic nested array joins its cycle as empty'
+        );
+
+        var customJoin = [{ toString: 'x' }];
+        customJoin.join = function () { return 'j'; };
+        st.equal(qs.stringify({ a: [customJoin, 'y'] }, { arrayFormat: 'comma', encode: false }), 'a=j,y', 'own `join` is still used');
+
+        st.equal(
+            qs.stringify({ a: [{ toString: 'x', valueOf: function () { return 7; } }] }, { arrayFormat: 'comma' }),
+            'a=7',
+            'primitive `valueOf` is still used'
+        );
+        st.equal(
+            qs.stringify({ a: [{ toString: 'x', valueOf: function () { return null; } }] }, { arrayFormat: 'comma' }),
+            'a=null',
+            'null `valueOf` is still used'
+        );
+        st.equal(
+            qs.stringify({ a: [{ toString: 'x', valueOf: function () { return {}; } }] }, { arrayFormat: 'comma' }),
+            'a=%5Bobject%20Object%5D',
+            'non-primitive `valueOf` falls back'
+        );
+
+        st.equal(
+            qs.stringify({ a: [{ toString: function () { return 't'; } }, new Date(0)] }, { arrayFormat: 'comma', encode: false }),
+            'a=t,1970-01-01T00:00:00.000Z',
+            'callable `toString` and dates are unaffected'
+        );
+
+        st['throws'](
+            function () {
+                qs.stringify({ a: [{ toString: function () { throw new SyntaxError('mine'); } }] }, { arrayFormat: 'comma' });
+            },
+            SyntaxError,
+            'a throwing `toString` still throws'
+        );
+        st['throws'](
+            function () {
+                qs.stringify({ a: [{ toString: 'x', valueOf: function () { throw new EvalError('mine'); } }] }, { arrayFormat: 'comma' });
+            },
+            EvalError,
+            'a throwing `valueOf` still throws'
+        );
+
+        st.end();
+    });
+
+    t.test('arrayFormat=comma: entries with `Symbol.toPrimitive` are unaffected', { skip: !hasSymbols() || typeof Symbol.toPrimitive !== 'symbol' }, function (st) {
+        var entry = { toString: 'x' };
+        entry[Symbol.toPrimitive] = function () { return 'p'; };
+        st.equal(qs.stringify({ a: [entry] }, { arrayFormat: 'comma' }), 'a=p');
+        st.equal(qs.stringify({ a: [entry] }, { arrayFormat: 'comma', encodeValuesOnly: true }), 'a=p');
+
+        st.end();
+    });
+
     t.test('stringifies a null object', { skip: !hasProto }, function (st) {
         st.equal(qs.stringify({ __proto__: null, a: 'b' }), 'a=b');
         st.end();
@@ -1095,6 +1411,53 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('applies sort to nested keys selected by filter=array', function (st) {
+        var asc = function (a, b) { return a.localeCompare(b); };
+        var desc = function (a, b) { return b.localeCompare(a); };
+
+        st.equal(
+            qs.stringify({ a: { c: 1, b: 2 }, z: 3 }, { filter: ['z', 'a', 'c', 'b'], sort: asc, encode: false }),
+            'a[b]=2&a[c]=1&z=3',
+            'nested keys are sorted, not left in filter order'
+        );
+        st.equal(
+            qs.stringify({ a: { c: 1, b: 2 }, z: 3 }, { filter: ['z', 'b', 'a', 'c'], sort: desc, encode: false }),
+            'z=3&a[c]=1&a[b]=2',
+            'nested keys follow a descending sort'
+        );
+        st.equal(
+            qs.stringify({ a: [{ y: 1, x: 2 }] }, { filter: ['a', '0', 'y', 'x'], sort: asc, encode: false }),
+            'a[0][x]=2&a[0][y]=1',
+            'keys of objects nested in arrays are sorted'
+        );
+        st.equal(
+            qs.stringify({ a: { c: 1, b: 2 }, z: 3 }, { filter: ['z', 'a', 'c', 'b'], encode: false }),
+            'z=3&a[c]=1&a[b]=2',
+            'without sort, keys keep filter order at every level'
+        );
+
+        st.end();
+    });
+
+    t.test('does not reorder the caller\'s filter array when sorting', function (st) {
+        var filter = ['z', 'a', 'c', 'b'];
+        var asc = function (a, b) { return a.localeCompare(b); };
+
+        st.equal(
+            qs.stringify({ a: { c: 1, b: 2 }, z: 3 }, { filter: filter, sort: asc, encode: false }),
+            'a[b]=2&a[c]=1&z=3',
+            'keys are sorted at every level'
+        );
+        st.deepEqual(filter, ['z', 'a', 'c', 'b'], 'filter array is not mutated');
+        st.equal(
+            qs.stringify({ a: { c: 1, b: 2 }, z: 3 }, { filter: filter, encode: false }),
+            'z=3&a[c]=1&a[b]=2',
+            'reusing the filter without sort keeps its own order'
+        );
+
+        st.end();
+    });
+
     t.test('supports custom representations when filter=function', function (st) {
         var calls = 0;
         var obj = { a: 'b', c: 'd', e: { f: new Date(1257894000000) } };
@@ -1345,6 +1708,7 @@ test('stringify()', function (t) {
         st.equal(qs.stringify({ 'a b': SaferBuffer.from('a b') }, { format: qs.formats.RFC1738 }), 'a+b=a+b');
 
         st.equal(qs.stringify({ 'foo(ref)': 'bar' }, { format: qs.formats.RFC1738 }), 'foo(ref)=bar');
+        st.equal(qs.stringify({ 'a~*': '~*()' }, { format: qs.formats.RFC1738 }), 'a~%2A=~%2A()', 'leaves `~` unencoded and encodes `*`');
 
         st.end();
     });
@@ -1353,6 +1717,83 @@ test('stringify()', function (t) {
         st.equal(qs.stringify({ a: 'b c' }, { format: qs.formats.RFC3986 }), 'a=b%20c');
         st.equal(qs.stringify({ 'a b': 'c d' }, { format: qs.formats.RFC3986 }), 'a%20b=c%20d');
         st.equal(qs.stringify({ 'a b': SaferBuffer.from('a b') }, { format: qs.formats.RFC3986 }), 'a%20b=a%20b');
+        st.equal(qs.stringify({ 'a~*': '~*()' }, { format: qs.formats.RFC3986 }), 'a~%2A=~%2A%28%29', 'leaves `~` unencoded, and encodes `*` and parens');
+
+        st.end();
+    });
+
+    t.test('WHATWG serialization', function (st) {
+        st.equal(qs.formats.WHATWG, 'WHATWG', 'is exported');
+        st.equal(qs.stringify({ a: 'b c' }, { format: qs.formats.WHATWG }), 'a=b+c');
+        st.equal(qs.stringify({ 'a b': 'c d' }, { format: qs.formats.WHATWG }), 'a+b=c+d');
+        st.equal(qs.stringify({ 'a b': SaferBuffer.from('a b') }, { format: qs.formats.WHATWG }), 'a+b=a+b');
+
+        st.equal(qs.stringify({ a: '~' }, { format: qs.formats.WHATWG }), 'a=%7E', 'encodes `~`');
+        st.equal(qs.stringify({ a: '*' }, { format: qs.formats.WHATWG }), 'a=*', 'does not encode `*`');
+        st.equal(qs.stringify({ 'foo(ref)': 'bar' }, { format: qs.formats.WHATWG }), 'foo%28ref%29=bar', 'encodes parentheses');
+        st.equal(qs.stringify({ a: '-._' }, { format: qs.formats.WHATWG }), 'a=-._');
+        st.equal(qs.stringify({ a: '+&=' }, { format: qs.formats.WHATWG }), 'a=%2B%26%3D');
+        st.equal(qs.stringify({ a: { b: 'c d' } }, { format: qs.formats.WHATWG }), 'a%5Bb%5D=c+d');
+        st.equal(qs.stringify({ a: 'b c' }, { format: qs.formats.WHATWG, encode: false }), 'a=b c', 'encode: false leaves the value alone');
+
+        st.equal(
+            qs.stringify({ 'a~b*': { 'c d': '~* ' } }, { format: qs.formats.WHATWG, encodeValuesOnly: true }),
+            'a~b*[c d]=%7E*+',
+            'encodeValuesOnly: leaves keys alone'
+        );
+        st.equal(
+            qs.stringify({ a: '~*\u00e9 ' }, { format: qs.formats.WHATWG, charset: 'iso-8859-1' }),
+            'a=%7E*%E9+',
+            'charset iso-8859-1'
+        );
+        st.equal(
+            qs.stringify({ a: '~* ' }, {
+                format: qs.formats.WHATWG,
+                encoder: function (str, defaultEncoder, charset, type, format) {
+                    return defaultEncoder(str, defaultEncoder, charset, type, format);
+                }
+            }),
+            'a=%7E*+',
+            'an encoder wrapping the default encoder'
+        );
+        st.equal(
+            qs.stringify({ a: ['~ x', '*'] }, { format: qs.formats.WHATWG, arrayFormat: 'comma' }),
+            'a=%7E+x%2C*',
+            'arrayFormat comma'
+        );
+
+        st.end();
+    });
+
+    var USP = typeof URLSearchParams === 'function' ? URLSearchParams : url.URLSearchParams;
+
+    t.test('WHATWG serialization matches URLSearchParams', { skip: typeof USP !== 'function' }, function (st) {
+        var chars = [];
+        for (var c = 0; c < 0x80; c++) {
+            chars[chars.length] = String.fromCharCode(c);
+        }
+        chars.push('\u00e9', '\u20ac', '\uFFFF', '\uD83D\uDCA9', 'a b~c*d(e)f', '\uD800', '\uDC00', 'x\uDC00y');
+
+        for (var i = 0; i < chars.length; i++) {
+            var key = {};
+            key[chars[i]] = 'v';
+            st.equal(
+                qs.stringify({ k: chars[i] }, { format: qs.formats.WHATWG }),
+                new USP([['k', chars[i]]]).toString(),
+                'value ' + JSON.stringify(chars[i])
+            );
+            st.equal(
+                qs.stringify(key, { format: qs.formats.WHATWG }),
+                new USP([[chars[i], 'v']]).toString(),
+                'key ' + JSON.stringify(chars[i])
+            );
+        }
+
+        st.equal(
+            qs.stringify({ a: { 'b~': 'c d' } }, { format: qs.formats.WHATWG }),
+            new USP([['a[b~]', 'c d']]).toString(),
+            'nested key'
+        );
 
         st.end();
     });
@@ -1480,6 +1921,17 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('encodes a literal `+` as `%2B` in iso-8859-1 mode so it round-trips', function (st) {
+        st.equal(qs.stringify({ a: 'b+c' }, { charset: 'iso-8859-1' }), 'a=b%2Bc', 'a `+` in a value is percent-encoded');
+        st.equal(qs.stringify({ 'a+b': 'c' }, { charset: 'iso-8859-1' }), 'a%2Bb=c', 'a `+` in a key is percent-encoded');
+        st.deepEqual(
+            qs.parse(qs.stringify({ a: 'b+c' }, { charset: 'iso-8859-1' }), { charset: 'iso-8859-1' }),
+            { a: 'b+c' },
+            'the `+` survives a round-trip instead of decoding to a space'
+        );
+        st.end();
+    });
+
     t.test('respects an explicit charset of utf-8 (the default)', function (st) {
         st.equal(qs.stringify({ a: 'æ' }, { charset: 'utf-8' }), 'a=%C3%A6');
         st.end();