@sap/cds-dk 10.2.0 → 10.2.1

package/node_modules/qs/test/stringify.js

@@ -5,6 +5,7 @@ var qs = require('../');
 var utils = require('../lib/utils');
 var iconv = require('iconv-lite');
 var SaferBuffer = require('safer-buffer').Buffer;
+var url = require('url');
 var hasSymbols = require('has-symbols');
 var mockProperty = require('mock-property');
 var emptyTestCases = require('./empty-keys-cases').emptyTestCases;
@@ -24,6 +25,28 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('stringifies lone surrogates as U+FFFD', function (st) {
+        st.equal(qs.stringify({ a: '\uD800x' }), 'a=%EF%BF%BDx', 'lone high surrogate does not swallow the next character');
+        st.equal(qs.stringify({ a: '\uDC00x' }), 'a=%EF%BF%BDx', 'lone low surrogate does not swallow the next character');
+        st.equal(qs.stringify({ '\uD800': 'b' }), '%EF%BF%BD=b', 'lone surrogate in a key');
+        st.deepEqual(qs.parse(qs.stringify({ a: 'x\uD800y' })), { a: 'x\uFFFDy' }, 'parses back with U+FFFD in place of the lone surrogate');
+        st.equal(qs.stringify({ '\uDC00': 'b' }), '%EF%BF%BD=b', 'lone low surrogate in a key');
+        st.equal(qs.stringify({ a: { 'b\uD800': 'c' } }), 'a%5Bb%EF%BF%BD%5D=c', 'lone surrogate in a nested key does not swallow the closing bracket');
+        st.equal(qs.stringify({ a: '\uD800 x' }, { format: 'RFC1738' }), 'a=%EF%BF%BD+x', 'lone surrogate does not swallow a space in RFC1738');
+        st.equal(
+            qs.stringify({ 'a\uD800': { b: 'c' } }, { allowDots: true, encodeDotInKeys: true }),
+            'a%EF%BF%BD.b=c',
+            'lone surrogate does not swallow a dot separator'
+        );
+        st.equal(qs.stringify({ a: ['x\uD800', 'y'] }, { arrayFormat: 'comma' }), 'a=x%EF%BF%BD%2Cy', 'lone surrogate does not swallow a comma');
+        st.equal(
+            qs.stringify({ a: ['x\uD800', 'y'] }, { arrayFormat: 'comma', encodeValuesOnly: true }),
+            'a=x%EF%BF%BD,y',
+            'lone surrogate at the end of a comma-joined element encodes as U+FFFD'
+        );
+        st.end();
+    });
+
     t.test('stringifies falsy values', function (st) {
         st.equal(qs.stringify(undefined), '');
         st.equal(qs.stringify(null), '');
@@ -520,6 +543,24 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('allowEmptyArrays keys that need no encoding', function (st) {
+        st.equal(qs.stringify({ foo: [] }, { allowEmptyArrays: true, format: 'RFC1738' }), 'foo[]', 'a top-level key in RFC1738');
+        st.equal(
+            qs.stringify({ a: { b: [] }, c: 'd e' }, { allowEmptyArrays: true, encodeValuesOnly: true }),
+            'a[b][]&c=d%20e',
+            'a nested key with encodeValuesOnly'
+        );
+        st.equal(qs.stringify({ a: { b: [] } }, { allowEmptyArrays: true, encode: false }), 'a[b][]', 'a nested key with encode: false');
+        st.equal(qs.stringify({ a: { b: [] } }, { allowEmptyArrays: true, allowDots: true }), 'a.b[]', 'a nested key with allowDots');
+        st.equal(
+            qs.stringify({ a: { b: [] } }, { allowEmptyArrays: true, allowDots: true, format: 'RFC1738' }),
+            'a.b[]',
+            'a nested key with allowDots in RFC1738'
+        );
+
+        st.end();
+    });
+
     t.test('allowEmptyArrays + strictNullHandling', function (st) {
         st.equal(
             qs.stringify(
@@ -565,6 +606,62 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('should encode the key of an empty array when allowEmptyArrays is set', function (st) {
+        st.equal(
+            qs.stringify({ 'a b': [] }, { allowEmptyArrays: true }),
+            'a%20b[]',
+            'default (RFC3986) percent-encodes the space in the key'
+        );
+        st.equal(
+            qs.stringify({ 'a b': [] }, { allowEmptyArrays: true, format: 'RFC1738' }),
+            'a+b[]',
+            'RFC1738 encodes the space in the key as a plus'
+        );
+        st.equal(
+            qs.stringify({ 'a b': [] }, { allowEmptyArrays: true, encodeValuesOnly: true }),
+            'a b[]',
+            'encodeValuesOnly leaves the key unencoded'
+        );
+        st.equal(
+            qs.stringify({ 'a b': [] }, { allowEmptyArrays: true, encode: false }),
+            'a b[]',
+            'encode: false leaves the key unencoded'
+        );
+
+        st.deepEqual(
+            qs.parse(qs.stringify({ 'a b': [], 'a&b=c': [] }, { allowEmptyArrays: true }), { allowEmptyArrays: true }),
+            { 'a b': [], 'a&b=c': [] },
+            'the encoded keys round-trip back to the original, including `&` and `=`'
+        );
+        st.equal(
+            qs.stringify({ 'a b': ['x'] }, { allowEmptyArrays: true, arrayFormat: 'brackets' }),
+            'a%20b%5B%5D=x',
+            'the same key with a value encodes the key prefix identically'
+        );
+        st.equal(
+            qs.stringify({ a: { 'b c': [] } }, { allowEmptyArrays: true }),
+            'a%5Bb%20c%5D[]',
+            'a nested key prefix is encoded like the value path encodes it'
+        );
+        st.equal(
+            qs.stringify({ a: { b: [] } }, { allowEmptyArrays: true }),
+            'a%5Bb%5D[]',
+            'a nested key that needs no encoding still has its brackets encoded'
+        );
+        st.equal(
+            qs.stringify({ 'a.b': [] }, { allowEmptyArrays: true, allowDots: true, encodeDotInKeys: true }),
+            'a%252Eb[]',
+            'encodeDotInKeys double-encodes the dot, as on the value path'
+        );
+        st.deepEqual(
+            qs.parse('a%252Eb[]', { allowEmptyArrays: true, allowDots: true, decodeDotInKeys: true }),
+            { 'a.b': [] },
+            'the encodeDotInKeys output round-trips'
+        );
+
+        st.end();
+    });
+
     t.test('stringifies an array value with one item vs multiple items', function (st) {
         st.test('non-array item', function (s2t) {
             s2t.equal(qs.stringify({ a: 'c' }, { encodeValuesOnly: true, arrayFormat: 'indices' }), 'a=c');
@@ -1314,6 +1411,53 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('applies sort to nested keys selected by filter=array', function (st) {
+        var asc = function (a, b) { return a.localeCompare(b); };
+        var desc = function (a, b) { return b.localeCompare(a); };
+
+        st.equal(
+            qs.stringify({ a: { c: 1, b: 2 }, z: 3 }, { filter: ['z', 'a', 'c', 'b'], sort: asc, encode: false }),
+            'a[b]=2&a[c]=1&z=3',
+            'nested keys are sorted, not left in filter order'
+        );
+        st.equal(
+            qs.stringify({ a: { c: 1, b: 2 }, z: 3 }, { filter: ['z', 'b', 'a', 'c'], sort: desc, encode: false }),
+            'z=3&a[c]=1&a[b]=2',
+            'nested keys follow a descending sort'
+        );
+        st.equal(
+            qs.stringify({ a: [{ y: 1, x: 2 }] }, { filter: ['a', '0', 'y', 'x'], sort: asc, encode: false }),
+            'a[0][x]=2&a[0][y]=1',
+            'keys of objects nested in arrays are sorted'
+        );
+        st.equal(
+            qs.stringify({ a: { c: 1, b: 2 }, z: 3 }, { filter: ['z', 'a', 'c', 'b'], encode: false }),
+            'z=3&a[c]=1&a[b]=2',
+            'without sort, keys keep filter order at every level'
+        );
+
+        st.end();
+    });
+
+    t.test('does not reorder the caller\'s filter array when sorting', function (st) {
+        var filter = ['z', 'a', 'c', 'b'];
+        var asc = function (a, b) { return a.localeCompare(b); };
+
+        st.equal(
+            qs.stringify({ a: { c: 1, b: 2 }, z: 3 }, { filter: filter, sort: asc, encode: false }),
+            'a[b]=2&a[c]=1&z=3',
+            'keys are sorted at every level'
+        );
+        st.deepEqual(filter, ['z', 'a', 'c', 'b'], 'filter array is not mutated');
+        st.equal(
+            qs.stringify({ a: { c: 1, b: 2 }, z: 3 }, { filter: filter, encode: false }),
+            'z=3&a[c]=1&a[b]=2',
+            'reusing the filter without sort keeps its own order'
+        );
+
+        st.end();
+    });
+
     t.test('supports custom representations when filter=function', function (st) {
         var calls = 0;
         var obj = { a: 'b', c: 'd', e: { f: new Date(1257894000000) } };
@@ -1564,6 +1708,7 @@ test('stringify()', function (t) {
         st.equal(qs.stringify({ 'a b': SaferBuffer.from('a b') }, { format: qs.formats.RFC1738 }), 'a+b=a+b');
 
         st.equal(qs.stringify({ 'foo(ref)': 'bar' }, { format: qs.formats.RFC1738 }), 'foo(ref)=bar');
+        st.equal(qs.stringify({ 'a~*': '~*()' }, { format: qs.formats.RFC1738 }), 'a~%2A=~%2A()', 'leaves `~` unencoded and encodes `*`');
 
         st.end();
     });
@@ -1572,6 +1717,83 @@ test('stringify()', function (t) {
         st.equal(qs.stringify({ a: 'b c' }, { format: qs.formats.RFC3986 }), 'a=b%20c');
         st.equal(qs.stringify({ 'a b': 'c d' }, { format: qs.formats.RFC3986 }), 'a%20b=c%20d');
         st.equal(qs.stringify({ 'a b': SaferBuffer.from('a b') }, { format: qs.formats.RFC3986 }), 'a%20b=a%20b');
+        st.equal(qs.stringify({ 'a~*': '~*()' }, { format: qs.formats.RFC3986 }), 'a~%2A=~%2A%28%29', 'leaves `~` unencoded, and encodes `*` and parens');
+
+        st.end();
+    });
+
+    t.test('WHATWG serialization', function (st) {
+        st.equal(qs.formats.WHATWG, 'WHATWG', 'is exported');
+        st.equal(qs.stringify({ a: 'b c' }, { format: qs.formats.WHATWG }), 'a=b+c');
+        st.equal(qs.stringify({ 'a b': 'c d' }, { format: qs.formats.WHATWG }), 'a+b=c+d');
+        st.equal(qs.stringify({ 'a b': SaferBuffer.from('a b') }, { format: qs.formats.WHATWG }), 'a+b=a+b');
+
+        st.equal(qs.stringify({ a: '~' }, { format: qs.formats.WHATWG }), 'a=%7E', 'encodes `~`');
+        st.equal(qs.stringify({ a: '*' }, { format: qs.formats.WHATWG }), 'a=*', 'does not encode `*`');
+        st.equal(qs.stringify({ 'foo(ref)': 'bar' }, { format: qs.formats.WHATWG }), 'foo%28ref%29=bar', 'encodes parentheses');
+        st.equal(qs.stringify({ a: '-._' }, { format: qs.formats.WHATWG }), 'a=-._');
+        st.equal(qs.stringify({ a: '+&=' }, { format: qs.formats.WHATWG }), 'a=%2B%26%3D');
+        st.equal(qs.stringify({ a: { b: 'c d' } }, { format: qs.formats.WHATWG }), 'a%5Bb%5D=c+d');
+        st.equal(qs.stringify({ a: 'b c' }, { format: qs.formats.WHATWG, encode: false }), 'a=b c', 'encode: false leaves the value alone');
+
+        st.equal(
+            qs.stringify({ 'a~b*': { 'c d': '~* ' } }, { format: qs.formats.WHATWG, encodeValuesOnly: true }),
+            'a~b*[c d]=%7E*+',
+            'encodeValuesOnly: leaves keys alone'
+        );
+        st.equal(
+            qs.stringify({ a: '~*\u00e9 ' }, { format: qs.formats.WHATWG, charset: 'iso-8859-1' }),
+            'a=%7E*%E9+',
+            'charset iso-8859-1'
+        );
+        st.equal(
+            qs.stringify({ a: '~* ' }, {
+                format: qs.formats.WHATWG,
+                encoder: function (str, defaultEncoder, charset, type, format) {
+                    return defaultEncoder(str, defaultEncoder, charset, type, format);
+                }
+            }),
+            'a=%7E*+',
+            'an encoder wrapping the default encoder'
+        );
+        st.equal(
+            qs.stringify({ a: ['~ x', '*'] }, { format: qs.formats.WHATWG, arrayFormat: 'comma' }),
+            'a=%7E+x%2C*',
+            'arrayFormat comma'
+        );
+
+        st.end();
+    });
+
+    var USP = typeof URLSearchParams === 'function' ? URLSearchParams : url.URLSearchParams;
+
+    t.test('WHATWG serialization matches URLSearchParams', { skip: typeof USP !== 'function' }, function (st) {
+        var chars = [];
+        for (var c = 0; c < 0x80; c++) {
+            chars[chars.length] = String.fromCharCode(c);
+        }
+        chars.push('\u00e9', '\u20ac', '\uFFFF', '\uD83D\uDCA9', 'a b~c*d(e)f', '\uD800', '\uDC00', 'x\uDC00y');
+
+        for (var i = 0; i < chars.length; i++) {
+            var key = {};
+            key[chars[i]] = 'v';
+            st.equal(
+                qs.stringify({ k: chars[i] }, { format: qs.formats.WHATWG }),
+                new USP([['k', chars[i]]]).toString(),
+                'value ' + JSON.stringify(chars[i])
+            );
+            st.equal(
+                qs.stringify(key, { format: qs.formats.WHATWG }),
+                new USP([[chars[i], 'v']]).toString(),
+                'key ' + JSON.stringify(chars[i])
+            );
+        }
+
+        st.equal(
+            qs.stringify({ a: { 'b~': 'c d' } }, { format: qs.formats.WHATWG }),
+            new USP([['a[b~]', 'c d']]).toString(),
+            'nested key'
+        );
 
         st.end();
     });

package/node_modules/qs/test/utils.js

@@ -742,7 +742,7 @@ test('encode', function (t) {
         loneExpected += 'a';
     }
     loneBoundary += '\uD83DX';
-    loneExpected += '%F0%9F%91%98';
+    loneExpected += '%EF%BF%BDX';
 
     t.equal(
         utils.encode(loneBoundary),
@@ -750,6 +750,17 @@ test('encode', function (t) {
         'a lone high surrogate at a chunk boundary encodes the same as mid-chunk'
     );
 
+    t.equal(
+        utils.encode(loneBoundary.slice(0, 1023) + '\uDC00X'),
+        loneExpected.slice(0, 1023) + '%EF%BF%BDX',
+        'a lone low surrogate at a chunk boundary does not consume the next character'
+    );
+    t.equal(
+        utils.encode(loneBoundary.slice(0, 1024)),
+        loneExpected.slice(0, 1023) + '%EF%BF%BD',
+        'a lone high surrogate ending a string of exactly one chunk encodes as U+FFFD'
+    );
+
     t.equal(
         utils.encode('\x28\x29'),
         '%28%29',
@@ -761,8 +772,30 @@ test('encode', function (t) {
         'does not encode parens in RFC1738'
     );
 
+    t.equal(
+        utils.encode('~*()'),
+        '~%2A%28%29',
+        'leaves `~` unencoded, and encodes `*` and parens, by default'
+    );
+    t.equal(
+        utils.encode('~*()', null, null, null, 'RFC3986'),
+        '~%2A%28%29',
+        'leaves `~` unencoded, and encodes `*` and parens, in RFC3986'
+    );
+    t.equal(
+        utils.encode('~*() ', null, null, null, 'RFC1738'),
+        '~%2A()%20',
+        'leaves `~` and parens unencoded, and encodes `*` and spaces, in RFC1738'
+    );
+
     // todo RFC1738 format
 
+    t.equal(
+        utils.encode('~*()', null, null, null, 'WHATWG'),
+        '%7E*%28%29',
+        'encodes `~` and parens, but not `*`, in WHATWG'
+    );
+
     t.equal(
         utils.encode('Āက豈'),
         '%C4%80%E1%80%80%EF%A4%80',
@@ -771,8 +804,33 @@ test('encode', function (t) {
 
     t.equal(
         utils.encode('\uD83D \uDCA9'),
-        '%F0%9F%90%A0%F0%BA%90%80',
-        'encodes lone surrogates'
+        '%EF%BF%BD%20%EF%BF%BD',
+        'encodes lone surrogates as U+FFFD, without consuming the next character'
+    );
+    t.equal(
+        utils.encode('\uDCA9\uD83D'),
+        '%EF%BF%BD%EF%BF%BD',
+        'encodes a reversed surrogate pair as two U+FFFD'
+    );
+    t.equal(
+        utils.encode('x\uD83D'),
+        'x%EF%BF%BD',
+        'encodes a trailing lone high surrogate as U+FFFD'
+    );
+    t.equal(
+        utils.encode('\uD83D\uD83D\uDCA9'),
+        '%EF%BF%BD%F0%9F%92%A9',
+        'a lone high surrogate does not prevent the following pair from encoding'
+    );
+    t.equal(
+        utils.encode('\uD83D\uE000'),
+        '%EF%BF%BD%EE%80%80',
+        'a high surrogate followed by a code unit above the low surrogate range is not combined'
+    );
+    t.equal(
+        utils.encode('\uDC00\uDC00'),
+        '%EF%BF%BD%EF%BF%BD',
+        'a low surrogate followed by a low surrogate is not combined'
     );
 
     t.end();

package/node_modules/semver/classes/range.js

@@ -119,7 +119,7 @@ class Range {
     debug('hyphen replace', range)
 
     // `> 1.2.3 < 1.2.5` => `>1.2.3 <1.2.5`
-    range = range.replace(re[t.COMPARATORTRIM], comparatorTrimReplace)
+    range = trimComparatorWhitespace(range)
     debug('comparator trim', range)
 
     // `~ 1.2.3` => `~1.2.3`
@@ -224,11 +224,11 @@ const parseOptions = require('../internal/parse-options')
 const Comparator = require('./comparator')
 const debug = require('../internal/debug')
 const SemVer = require('./semver')
+const trimComparatorWhitespace = require('../internal/trim-comparator-whitespace')
 const {
   safeRe: re,
   src,
   t,
-  comparatorTrimReplace,
   tildeTrimReplace,
   caretTrimReplace,
 } = require('../internal/re')

package/node_modules/semver/internal/constants.js

@@ -15,6 +15,35 @@ const MAX_SAFE_COMPONENT_LENGTH = 16
 // the shortest version with a build 0.0.0+BUILD.
 const MAX_SAFE_BUILD_LENGTH = MAX_LENGTH - 6
 
+// ECMAScript whitespace and line terminators matched by \s.
+const WHITESPACE_CHARACTERS = [
+  '\t',
+  '\n',
+  '\v',
+  '\f',
+  '\r',
+  ' ',
+  '\u00a0',
+  '\u1680',
+  '\u2000',
+  '\u2001',
+  '\u2002',
+  '\u2003',
+  '\u2004',
+  '\u2005',
+  '\u2006',
+  '\u2007',
+  '\u2008',
+  '\u2009',
+  '\u200a',
+  '\u2028',
+  '\u2029',
+  '\u202f',
+  '\u205f',
+  '\u3000',
+  '\ufeff',
+]
+
 const RELEASE_TYPES = [
   'major',
   'premajor',
@@ -30,6 +59,7 @@ module.exports = {
   MAX_SAFE_COMPONENT_LENGTH,
   MAX_SAFE_BUILD_LENGTH,
   MAX_SAFE_INTEGER,
+  WHITESPACE_CHARACTERS,
   RELEASE_TYPES,
   SEMVER_SPEC_VERSION,
   FLAG_INCLUDE_PRERELEASE: 0b001,