@suveren/gateway 0.29.0 → 0.30.0

package/node_modules/qs/test/parse.js

@@ -62,10 +62,39 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('comma: `[]=` in a value does not wrap the value in an extra array', function (st) {
+        st.deepEqual(qs.parse('a[b]=1,2,3[]=x', { comma: true }), { a: { b: ['1', '2', '3[]=x'] } });
+        st.deepEqual(qs.parse('a[b]=1,2[]=3', { comma: true }), { a: { b: ['1', '2[]=3'] } });
+        st.deepEqual(qs.parse('a[]=1,2,3', { comma: true }), { a: [['1', '2', '3']] });
+        st.end();
+    });
+
     t.test('allows enabling dot notation', function (st) {
         st.deepEqual(qs.parse('a.b=c'), { 'a.b': 'c' });
         st.deepEqual(qs.parse('a.b=c', { allowDots: true }), { a: { b: 'c' } });
 
+        // a literal dot inside a bracket segment must not be rewritten by allowDots (#617)
+        st.deepEqual(
+            qs.parse('outer[a.b]=1', { allowDots: true }),
+            { outer: { 'a.b': '1' } },
+            'a dot inside brackets stays part of the key when allowDots is true'
+        );
+        st.deepEqual(
+            qs.parse('outer[a.b]=1', { allowDots: true }),
+            qs.parse('outer[a.b]=1', { allowDots: false }),
+            'allowDots does not change how a bracket segment containing a dot is parsed'
+        );
+        st.deepEqual(
+            qs.parse('a].b=c', { allowDots: true }),
+            { 'a]': { b: 'c' } },
+            'a stray close bracket does not stop a later dot from being converted'
+        );
+        st.deepEqual(
+            qs.parse('a]].b[c.d]=e', { allowDots: true }),
+            { 'a]]': { b: { 'c.d': 'e' } } },
+            'stray close brackets do not unbalance a later bracket segment'
+        );
+
         st.end();
     });
 
@@ -360,6 +389,14 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('currently moves the key/value split to a later `]=` when the first `=` comes before any bracket group', function (st) {
+        characterizeParse(st, 'a=b[c]=d', undefined, { 'a=b': { c: 'd' } }, 'literal brackets after the first `=`');
+        characterizeParse(st, 'q=%5B1%5D=2', undefined, { 'q=': ['2'] }, 'encoded brackets collapse to an array');
+        characterizeParse(st, 'role=guest%5Bx%5Dy%5D=z', undefined, { 'role=guest': { x: 'z' } }, 'group opens after the first `=`, and the text after it is dropped');
+        characterizeParse(st, 'role=guest%5D=admin', undefined, { 'role=guest]': 'admin' }, 'encoded `]=` with no bracket group at all');
+        st.end();
+    });
+
     t.test('allows to specify array indices', function (st) {
         st.deepEqual(qs.parse('a[1]=c&a[0]=b&a[2]=d'), { a: ['b', 'c', 'd'] });
         st.deepEqual(qs.parse('a[1]=c&a[0]=b'), { a: ['b', 'c'] });
@@ -745,6 +782,38 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('does not mutate an object input', function (st) {
+        var arr = ['x'];
+        st.deepEqual(qs.parse({ a: arr, 'a[]': 'y' }), { a: ['x', 'y'] }, 'appends to a copy of an input array');
+        st.deepEqual(arr, ['x'], 'the input array is unchanged');
+
+        var nested = { b: ['x'] };
+        st.deepEqual(qs.parse({ a: nested, 'a[b][]': 'y' }), { a: { b: ['x', 'y'] } }, 'appends to a copy of a nested input array');
+        st.deepEqual(nested, { b: ['x'] }, 'the nested input array is unchanged');
+
+        var obj = { b: 'c' };
+        st.deepEqual(qs.parse({ a: obj, 'a[d]': 'e' }), { a: { b: 'c', d: 'e' } }, 'merges into a copy of an input object');
+        st.deepEqual(obj, { b: 'c' }, 'the input object is unchanged');
+
+        var sparse = { b: [1, undefined, 2] };
+        st.deepEqual(qs.parse({ a: sparse }), { a: { b: [1, 2] } }, 'compacts a copy of an input array');
+        st.deepEqual(sparse, { b: [1, undefined, 2] }, 'the input array is not compacted');
+
+        var nullProto = { __proto__: null, b: 'c' };
+        st.equal(Object.getPrototypeOf(qs.parse({ a: nullProto }).a), null, 'a null-prototype input object stays null-prototype');
+
+        var date = new Date(0);
+        st.equal(qs.parse({ a: date }).a, date, 'a non-plain object is not copied');
+
+        var cyclic = { b: 'c' };
+        cyclic.self = cyclic;
+        var result = qs.parse({ a: cyclic });
+        st.notEqual(result.a, cyclic, 'a cyclic input object is copied');
+        st.equal(result.a.self, result.a, 'the copy keeps the cycle');
+
+        st.end();
+    });
+
     t.test('does not blow up when Buffer global is missing', function (st) {
         var restore = mockProperty(global, 'Buffer', { 'delete': true });
 
@@ -962,6 +1031,38 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('strictMerge conflicts do not overwrite indexed values already at that path', function (st) {
+        st.deepEqual(
+            qs.parse('a[z]=o&a=p&a[y]=q&a[2]=keep&[a]=r'),
+            { a: { 0: { z: 'o' }, 1: 'p', 2: 'keep', 3: 'r', y: 'q' } },
+            'an indexed key merged into the container is kept'
+        );
+
+        st.deepEqual(
+            qs.parse('a[z]=o&a=p&a[2]=keep&a[y]=q&[a]=r'),
+            { a: { 0: { z: 'o' }, 1: 'p', 2: 'keep', 3: 'r', y: 'q' } },
+            'an indexed key that extended the container while it was an array is kept'
+        );
+
+        st.end();
+    });
+
+    t.test('strictMerge conflicts do not overwrite values once the container overflows', function (st) {
+        st.deepEqual(
+            qs.parse('a[z]=v0&a=v1&a[y]=v2&[a]=v3&[a]x=v4&a[2]=v5&[a]x1=v6', { arrayLimit: 2 }),
+            { a: { 0: { z: 'v0' }, 1: 'v1', 2: ['v3', 'v5'], 3: 'v4', 4: 'v6', y: 'v2' } },
+            'a conflict appended after the container overflowed keeps every value'
+        );
+
+        st.deepEqual(
+            qs.parse('a[2]=v1&a=v5&a=v7&[a]x=v9', { parseArrays: false, arrayLimit: 1 }),
+            { a: { 0: 'v5', 1: 'v7', 2: 'v1', 3: 'v9' } },
+            'an index the container already holds is not reused'
+        );
+
+        st.end();
+    });
+
     t.test('dunder proto is ignored', function (st) {
         var payload = 'categories[__proto__]=login&categories[__proto__]&categories[length]=42';
         var result = qs.parse(payload, { allowPrototypes: true });
@@ -1463,6 +1564,57 @@ test('parse()', function (t) {
             sst.end();
         });
 
+        st.test('enforces arrayLimit when a strictMerge conflict appends to its container', function (sst) {
+            var aliased = 'a[z]=o&a=p&a[y]=q&[a]=r';
+            sst['throws'](
+                function () { qs.parse(aliased, { arrayLimit: 2, throwOnLimitExceeded: true }); },
+                new RangeError('Array limit exceeded. Only 2 elements allowed in an array.'),
+                'a third conflicting value throws once the container would exceed arrayLimit'
+            );
+            sst.deepEqual(
+                qs.parse(aliased, { arrayLimit: 3, throwOnLimitExceeded: true }),
+                { a: { 0: { z: 'o' }, 1: 'p', 2: 'r', y: 'q' } },
+                'appends while the container stays within arrayLimit'
+            );
+            sst.deepEqual(
+                qs.parse(aliased, { arrayLimit: 2 }),
+                { a: { 0: { z: 'o' }, 1: 'p', 2: 'r', y: 'q' } },
+                'appends without throwing when throwOnLimitExceeded is not set'
+            );
+
+            sst.end();
+        });
+
+        st.test('enforces arrayLimit when differently spelled keys collide', function (sst) {
+            sst['throws'](
+                function () { qs.parse('[a]=x&a=y', { arrayLimit: 1, throwOnLimitExceeded: true }); },
+                new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
+                'two primitives throw, as `a=x&a=y` does'
+            );
+            sst['throws'](
+                function () { qs.parse('a[b]=x&a=y', { arrayLimit: 1, throwOnLimitExceeded: true }); },
+                new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
+                'an object and a primitive throw under strictMerge'
+            );
+            sst.deepEqual(
+                qs.parse('[a]=x&a=y', { arrayLimit: 1 }),
+                { a: { 0: 'x', 1: 'y' } },
+                'without throwOnLimitExceeded, two primitives convert to an object, as `a=x&a=y` does'
+            );
+            sst.deepEqual(
+                qs.parse('a[b]=x&a=y', { arrayLimit: 1 }),
+                { a: { 0: { b: 'x' }, 1: 'y' } },
+                'and so do an object and a primitive'
+            );
+            sst.deepEqual(
+                qs.parse('a[b]=x&a=y', { arrayLimit: 2, throwOnLimitExceeded: true }),
+                { a: [{ b: 'x' }, 'y'] },
+                'a collision within arrayLimit is still an array'
+            );
+
+            sst.end();
+        });
+
         st.test('does not throw when cumulative comma combine stays within arrayLimit', function (sst) {
             var result = qs.parse('a=1,2,3&a=4', { comma: true, arrayLimit: 5, throwOnLimitExceeded: true });
             sst.deepEqual(result, { a: ['1', '2', '3', '4'] }, 'combined array within limit is preserved');
@@ -1807,6 +1959,28 @@ test('`duplicates` option', function (t) {
         st.end();
     });
 
+    t.test('`[]=` in a value does not force combining', function (st) {
+        st.deepEqual(
+            qs.parse('a[b]=1&a[b]=2[]=3', { duplicates: 'last' }),
+            { a: { b: '2[]=3' } },
+            'duplicates last: `[]=` in the value is not a bracketed key'
+        );
+
+        st.deepEqual(
+            qs.parse('a[b]=1&a[b]=2[]=3', { duplicates: 'first' }),
+            { a: { b: '1' } },
+            'duplicates first: `[]=` in the value is not a bracketed key'
+        );
+
+        st.deepEqual(
+            qs.parse('a[b]=1&a[b]=2[]=3', { duplicates: 'combine' }),
+            { a: { b: ['1', '2[]=3'] } },
+            'duplicates combine: still combines'
+        );
+
+        st.end();
+    });
+
     t.end();
 });
 

package/node_modules/qs/test/stringify.js

@@ -212,63 +212,94 @@ test('stringify()', function (t) {
         st.end();
     });
 
-    // Characterization of the CURRENT (buggy) behavior: with `allowDots` + `encodeDotInKeys`,
-    // `stringify` percent-encodes the structural `.` separators that `allowDots` inserts between
-    // nested keys, not just the literal dots inside a key, which breaks the stringify -> parse
-    // round-trip. These assertions pin that behavior so it cannot change silently: the fix in
-    // https://github.com/ljharb/qs/pull/564 changes every output below, so landing that fix MUST
-    // update this test (that is the point — it forces the behavior change to be explicit).
-    t.test('[characterization] encodeDotInKeys currently over-encodes structural separator dots (pre-#564)', function (st) {
+    t.test('does not encode the structural separator dots between nested keys when encodeDotInKeys and allowDots are provided', function (st) {
         st.equal(
-            qs.stringify({ a: { b: { c: 'd' } } }, { allowDots: true, encodeDotInKeys: true }),
-            'a%252Eb.c=d',
-            'over-encodes the a->b separator (#564: should become a.b.c=d)'
+            qs.stringify(
+                { a: { b: { c: 'd' } } },
+                { allowDots: true, encodeDotInKeys: true }
+            ),
+            'a.b.c=d',
+            'no key contains a literal dot, so encodeDotInKeys is a no-op on the separators'
         );
         st.equal(
-            qs.stringify({ a: { b: { c: { d: 'e' } } } }, { allowDots: true, encodeDotInKeys: true }),
-            'a%252Eb%252Ec.d=e',
-            'clobbers every separator but the last (#564: should become a.b.c.d=e)'
+            qs.stringify(
+                { a: { b: { c: { d: 'e' } } } },
+                { allowDots: true, encodeDotInKeys: true }
+            ),
+            'a.b.c.d=e',
+            'every nesting separator is preserved, not just the last one'
         );
-        st.equal(
-            qs.stringify({ 'a.b': { c: { d: 'e' } } }, { allowDots: true, encodeDotInKeys: true }),
-            'a%252Eb%252Ec.d=e',
-            'top-level dotted key: deeper separators also get encoded (#564: should become a%252Eb.c.d=e)'
+
+        st.deepEqual(
+            qs.parse(
+                qs.stringify({ a: { b: { c: 'd' } } }, { allowDots: true, encodeDotInKeys: true }),
+                { allowDots: true, decodeDotInKeys: true }
+            ),
+            { a: { b: { c: 'd' } } },
+            'stringify -> parse round-trips a deeply nested object'
         );
+
+        st.end();
+    });
+
+    t.test('encodeDotInKeys encodes only literal dots inside nested keys, never the structural separators, at any depth', function (st) {
         st.equal(
             qs.stringify({ a: { 'b.c': { d: 'e' } } }, { allowDots: true, encodeDotInKeys: true }),
-            'a%252Eb%252Ec.d=e',
-            'nested dotted key + object value: the separator around it is encoded (#564: should become a.b%252Ec.d=e)'
+            'a.b%252Ec.d=e',
+            'a nested key with a literal dot and an object value encodes only its own dot'
+        );
+        st.equal(
+            qs.stringify({ 'a.b': { c: { d: 'e' } } }, { allowDots: true, encodeDotInKeys: true }),
+            'a%252Eb.c.d=e',
+            'a top-level dotted key stays encoded while deeper separators stay literal'
         );
         st.equal(
             qs.stringify({ a: { b: { 'c.d': { e: 'f' } } } }, { allowDots: true, encodeDotInKeys: true }),
-            'a%252Eb%252Ec%252Ed.e=f',
-            'deeply nested dotted key: all separators encoded (#564: should become a.b.c%252Ed.e=f)'
+            'a.b.c%252Ed.e=f',
+            'a literal dot in a deeply nested key is encoded without touching the separators around it'
         );
 
         st.equal(
             qs.stringify({ a: { b: [1, 2] } }, { allowDots: true, encodeDotInKeys: true }),
-            'a%252Eb%5B0%5D=1&a%252Eb%5B1%5D=2',
-            'array value under nested keys: separator encoded (#564: should become a.b%5B0%5D=1&a.b%5B1%5D=2)'
+            'a.b%5B0%5D=1&a.b%5B1%5D=2',
+            'separator dots are preserved for an array value nested under keys'
         );
         st.equal(
             qs.stringify({ a: { 'b.c': [1, 2] } }, { allowDots: true, encodeDotInKeys: true }),
-            'a%252Eb%252Ec%5B0%5D=1&a%252Eb%252Ec%5B1%5D=2',
-            'array value under nested dotted key (#564: should become a.b%252Ec%5B0%5D=1&a.b%252Ec%5B1%5D=2)'
+            'a.b%252Ec%5B0%5D=1&a.b%252Ec%5B1%5D=2',
+            'a nested dotted key with an array value encodes only its own dot'
         );
 
-        st.equal(
-            qs.stringify({ a: { 'b.c': { d: 'e' } } }, { allowDots: false, encodeDotInKeys: true }),
-            'a%5Bb%252Ec%5D%5Bd%5D=e',
-            'allowDots:false object value encodes the nested-key dot, unlike the primitive-value case (#564: should become a%5Bb.c%5D%5Bd%5D=e)'
+        st.deepEqual(
+            qs.parse(
+                qs.stringify({ a: { 'b.c': { d: 'e' } } }, { allowDots: true, encodeDotInKeys: true }),
+                { allowDots: true, decodeDotInKeys: true }
+            ),
+            { a: { 'b.c': { d: 'e' } } },
+            'stringify -> parse round-trips a nested dotted key with an object value'
         );
-
         st.deepEqual(
             qs.parse(
-                qs.stringify({ a: { b: { c: 'd' } } }, { allowDots: true, encodeDotInKeys: true }),
+                qs.stringify({ 'a.b': { c: { d: 'e' } } }, { allowDots: true, encodeDotInKeys: true }),
                 { allowDots: true, decodeDotInKeys: true }
             ),
-            { 'a.b': { c: 'd' } },
-            'the over-encoding breaks the round-trip: {a:{b:{c}}} comes back as {"a.b":{c}} (#564 restores it)'
+            { 'a.b': { c: { d: 'e' } } },
+            'stringify -> parse round-trips a top-level dotted key with deep nesting'
+        );
+
+        st.end();
+    });
+
+    t.test('with allowDots false, encodeDotInKeys leaves nested-key dots literal, consistently for object and primitive values', function (st) {
+        st.equal(
+            qs.stringify({ a: { 'b.c': { d: 'e' } } }, { allowDots: false, encodeDotInKeys: true }),
+            'a%5Bb.c%5D%5Bd%5D=e',
+            'nested dotted key with an object value'
+        );
+        st.equal(
+            qs.stringify({ a: { 'b.c': 'e' } }, { allowDots: false, encodeDotInKeys: true }),
+            'a%5Bb.c%5D=e',
+            'nested dotted key with a primitive value matches the object-value case'
         );
 
         st.end();
@@ -394,6 +425,41 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('ignores inherited array format names', function (st) {
+        var array = { a: ['b', 'c'] };
+        var indices = 'a%5B0%5D=b&a%5B1%5D=c';
+        var repeat = 'a=b&a=c';
+
+        st.equal(qs.stringify(array, { arrayFormat: 'unsupported' }), indices, 'unknown format falls back to `indices`');
+
+        var names = [
+            'constructor',
+            'toString',
+            '__proto__',
+            'valueOf',
+            'hasOwnProperty',
+            'isPrototypeOf',
+            'propertyIsEnumerable',
+            'toLocaleString'
+        ];
+        for (var i = 0; i < names.length; i++) {
+            var name = names[i];
+            st.equal(qs.stringify(array, { arrayFormat: name }), indices, '`' + name + '` falls back to `indices`');
+            st.equal(
+                qs.stringify(array, { arrayFormat: name, indices: true }),
+                indices,
+                '`' + name + '` with `indices: true` falls back to `indices`'
+            );
+            st.equal(
+                qs.stringify(array, { arrayFormat: name, indices: false }),
+                repeat,
+                '`' + name + '` with `indices: false` falls back to `repeat`'
+            );
+        }
+
+        st.end();
+    });
+
     t.test('`skipNulls` option', function (st) {
         st.equal(
             qs.stringify({ a: 'b', c: null }, { skipNulls: true }),
@@ -569,6 +635,53 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('encodes comma array values with the same encoder arguments as other values, with encodeValuesOnly', function (st) {
+        var commaValuesOnly = { arrayFormat: 'comma', encodeValuesOnly: true };
+
+        st.equal(
+            qs.stringify({ a: ['é', 'x'], b: 'é' }, utils.assign({ charset: 'iso-8859-1' }, commaValuesOnly)),
+            'a=%E9,x&b=%E9',
+            'respects charset iso-8859-1'
+        );
+        st.deepEqual(
+            qs.parse(qs.stringify({ a: ['é', 'x'] }, utils.assign({ charset: 'iso-8859-1' }, commaValuesOnly)), { charset: 'iso-8859-1', comma: true }),
+            { a: ['é', 'x'] },
+            'round-trips in iso-8859-1'
+        );
+        st.equal(
+            qs.stringify({ a: ['☺'] }, utils.assign({ charset: 'iso-8859-1' }, commaValuesOnly)),
+            'a=%26%239786%3B',
+            'encodes unrepresentable chars as numeric entities in iso-8859-1'
+        );
+        st.equal(
+            qs.stringify({ a: ['(x)', 'y z'], b: '(x)' }, utils.assign({ format: qs.formats.RFC1738 }, commaValuesOnly)),
+            'a=(x),y+z&b=(x)',
+            'respects format RFC1738'
+        );
+
+        var calls = [];
+        st.equal(
+            qs.stringify({ a: ['b', 'c'] }, utils.assign({
+                encoder: function (str, defaultEncoder, charset, kind, format) {
+                    calls[calls.length] = [str, typeof defaultEncoder, charset, kind, format];
+                    return defaultEncoder(str, defaultEncoder, charset, kind, format).toUpperCase();
+                }
+            }, commaValuesOnly)),
+            'a=B,C',
+            'a custom encoder can call defaultEncoder'
+        );
+        st.deepEqual(
+            calls,
+            [
+                ['b', 'function', 'utf-8', 'value', qs.formats.RFC3986],
+                ['c', 'function', 'utf-8', 'value', qs.formats.RFC3986]
+            ],
+            'a custom encoder receives defaultEncoder, charset, kind, and format'
+        );
+
+        st.end();
+    });
+
     t.test('stringifies comma and empty non-array values', function (st) {
         st.equal(qs.stringify({ a: ',', b: '', c: 'c,d%' }, { encode: false, arrayFormat: 'indices' }), 'a=,&b=&c=c,d%');
         st.equal(qs.stringify({ a: ',', b: '', c: 'c,d%' }, { encode: false, arrayFormat: 'brackets' }), 'a=,&b=&c=c,d%');
@@ -865,6 +978,112 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('arrayFormat=comma: does not crash on entries with no callable `toString`', function (st) {
+        var json = JSON.parse('{ "a": ["b", { "toString": "x" }, "c"] }');
+        st.equal(qs.stringify(json, { arrayFormat: 'comma' }), 'a=b%2C%5Bobject%20Object%5D%2Cc', 'JSON own `toString`');
+        st.equal(qs.stringify(json, { arrayFormat: 'comma', encode: false }), 'a=b,[object Object],c', 'with encode: false');
+        st.equal(
+            qs.stringify(json, { arrayFormat: 'comma', encodeValuesOnly: true }),
+            'a=b,%5Bobject%20Object%5D,c',
+            'with encodeValuesOnly'
+        );
+        st.equal(
+            qs.stringify(JSON.parse('{ "a": [{ "toString": "x" }] }'), { arrayFormat: 'comma', commaRoundTrip: true }),
+            'a%5B%5D=%5Bobject%20Object%5D',
+            'with commaRoundTrip'
+        );
+        st.equal(
+            qs.stringify(JSON.parse('{ "a": [{ "toString": "x" }] }'), { arrayFormat: 'comma' }),
+            qs.stringify({ a: [{ b: 1 }] }, { arrayFormat: 'comma' }),
+            'renders the same as a plain object entry'
+        );
+
+        st.equal(
+            qs.stringify(qs.parse('a[][b]=c', { plainObjects: true }), { arrayFormat: 'comma' }),
+            'a=%5Bobject%20Object%5D',
+            'null-prototype entry from `parse` with plainObjects'
+        );
+        st.equal(
+            qs.stringify(qs.parse('a[][b]=c', { plainObjects: true }), { arrayFormat: 'comma', encodeValuesOnly: true }),
+            'a=%5Bobject%20Object%5D',
+            'null-prototype entry from `parse` with plainObjects, with encodeValuesOnly'
+        );
+        st.equal(
+            qs.stringify(qs.parse('a[0][toString]=x', { allowPrototypes: true }), { arrayFormat: 'comma' }),
+            'a=%5Bobject%20Object%5D',
+            'own `toString` entry from `parse` with allowPrototypes'
+        );
+
+        var nested = JSON.parse('{ "a": [[1, [{ "toString": "x" }]], "y"] }');
+        st.equal(qs.stringify(nested, { arrayFormat: 'comma', encode: false }), 'a=1,[object Object],y', 'nested array');
+        st.equal(
+            qs.stringify(nested, { arrayFormat: 'comma', encodeValuesOnly: true }),
+            'a=1%2C%5Bobject%20Object%5D,y',
+            'nested array, with encodeValuesOnly'
+        );
+        st.equal(qs.stringify({ a: [[1, 2], 3] }, { arrayFormat: 'comma', encode: false }), 'a=1,2,3', 'nested array is still flattened');
+
+        var cyclic = [{ toString: 'x' }];
+        cyclic[cyclic.length] = cyclic;
+        st.equal(
+            qs.stringify({ a: cyclic }, { arrayFormat: 'comma', encode: false }),
+            'a=[object Object],[object Object],',
+            'cyclic nested array joins its cycle as empty'
+        );
+
+        var customJoin = [{ toString: 'x' }];
+        customJoin.join = function () { return 'j'; };
+        st.equal(qs.stringify({ a: [customJoin, 'y'] }, { arrayFormat: 'comma', encode: false }), 'a=j,y', 'own `join` is still used');
+
+        st.equal(
+            qs.stringify({ a: [{ toString: 'x', valueOf: function () { return 7; } }] }, { arrayFormat: 'comma' }),
+            'a=7',
+            'primitive `valueOf` is still used'
+        );
+        st.equal(
+            qs.stringify({ a: [{ toString: 'x', valueOf: function () { return null; } }] }, { arrayFormat: 'comma' }),
+            'a=null',
+            'null `valueOf` is still used'
+        );
+        st.equal(
+            qs.stringify({ a: [{ toString: 'x', valueOf: function () { return {}; } }] }, { arrayFormat: 'comma' }),
+            'a=%5Bobject%20Object%5D',
+            'non-primitive `valueOf` falls back'
+        );
+
+        st.equal(
+            qs.stringify({ a: [{ toString: function () { return 't'; } }, new Date(0)] }, { arrayFormat: 'comma', encode: false }),
+            'a=t,1970-01-01T00:00:00.000Z',
+            'callable `toString` and dates are unaffected'
+        );
+
+        st['throws'](
+            function () {
+                qs.stringify({ a: [{ toString: function () { throw new SyntaxError('mine'); } }] }, { arrayFormat: 'comma' });
+            },
+            SyntaxError,
+            'a throwing `toString` still throws'
+        );
+        st['throws'](
+            function () {
+                qs.stringify({ a: [{ toString: 'x', valueOf: function () { throw new EvalError('mine'); } }] }, { arrayFormat: 'comma' });
+            },
+            EvalError,
+            'a throwing `valueOf` still throws'
+        );
+
+        st.end();
+    });
+
+    t.test('arrayFormat=comma: entries with `Symbol.toPrimitive` are unaffected', { skip: !hasSymbols() || typeof Symbol.toPrimitive !== 'symbol' }, function (st) {
+        var entry = { toString: 'x' };
+        entry[Symbol.toPrimitive] = function () { return 'p'; };
+        st.equal(qs.stringify({ a: [entry] }, { arrayFormat: 'comma' }), 'a=p');
+        st.equal(qs.stringify({ a: [entry] }, { arrayFormat: 'comma', encodeValuesOnly: true }), 'a=p');
+
+        st.end();
+    });
+
     t.test('stringifies a null object', { skip: !hasProto }, function (st) {
         st.equal(qs.stringify({ __proto__: null, a: 'b' }), 'a=b');
         st.end();
@@ -1480,6 +1699,17 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('encodes a literal `+` as `%2B` in iso-8859-1 mode so it round-trips', function (st) {
+        st.equal(qs.stringify({ a: 'b+c' }, { charset: 'iso-8859-1' }), 'a=b%2Bc', 'a `+` in a value is percent-encoded');
+        st.equal(qs.stringify({ 'a+b': 'c' }, { charset: 'iso-8859-1' }), 'a%2Bb=c', 'a `+` in a key is percent-encoded');
+        st.deepEqual(
+            qs.parse(qs.stringify({ a: 'b+c' }, { charset: 'iso-8859-1' }), { charset: 'iso-8859-1' }),
+            { a: 'b+c' },
+            'the `+` survives a round-trip instead of decoding to a space'
+        );
+        st.end();
+    });
+
     t.test('respects an explicit charset of utf-8 (the default)', function (st) {
         st.equal(qs.stringify({ a: 'æ' }, { charset: 'utf-8' }), 'a=%C3%A6');
         st.end();