@tickernelz/paperclip-pro-server 2026.1014.1 → 2026.1015.0

package/node_modules/qs/lib/utils.js

@@ -28,6 +28,23 @@ var setMaxIndex = function setMaxIndex(obj, maxIndex) {
     overflowChannel.set(obj, maxIndex);
 };
 
+// Track containers produced by a `strictMerge` conflict wrap, and their current max numeric index,
+// so repeated conflicts on one path append instead of nesting a new wrapper each time
+var conflictChannel = getSideChannel();
+
+var markConflict = function markConflict(obj, maxIndex) {
+    conflictChannel.set(obj, maxIndex);
+    return obj;
+};
+
+var isConflict = function isConflict(obj) {
+    return conflictChannel.has(obj);
+};
+
+var getConflictIndex = function getConflictIndex(obj) {
+    return conflictChannel.get(obj);
+};
+
 var hexTable = (function () {
     var array = [];
     for (var i = 0; i < 256; ++i) {
@@ -80,6 +97,30 @@ var setProperty = function setProperty(obj, key, value) {
     }
 };
 
+var maxNumericIndex = function maxNumericIndex(obj, min) {
+    var max = min;
+    var keys = Object.keys(obj);
+    for (var i = 0; i < keys.length; ++i) {
+        var num = parseInt(keys[i], 10);
+        if (String(num) === keys[i] && num > max) {
+            max = num;
+        }
+    }
+
+    return max;
+};
+
+var limitedPair = function limitedPair(first, second, options) {
+    var pair = [first, second];
+    if (options && typeof options.arrayLimit === 'number' && pair.length > options.arrayLimit) {
+        if (options.throwOnLimitExceeded) {
+            throw new RangeError('Array limit exceeded. Only ' + options.arrayLimit + ' element' + (options.arrayLimit === 1 ? '' : 's') + ' allowed in an array.');
+        }
+        return markOverflow(arrayToObject(pair, options), 1);
+    }
+    return pair;
+};
+
 var merge = function merge(target, source, options) {
     /* eslint no-param-reassign: 0 */
     if (!source) {
@@ -102,8 +143,20 @@ var merge = function merge(target, source, options) {
                 var newIndex = getMaxIndex(target) + 1;
                 target[newIndex] = source;
                 setMaxIndex(target, newIndex);
+            } else if (options && options.strictMerge && isConflict(target)) {
+                var nextConflict = getConflictIndex(target) + 1;
+                if (
+                    options.throwOnLimitExceeded
+                    && typeof options.arrayLimit === 'number'
+                    && nextConflict >= options.arrayLimit
+                ) {
+                    throw new RangeError('Array limit exceeded. Only ' + options.arrayLimit + ' element' + (options.arrayLimit === 1 ? '' : 's') + ' allowed in an array.');
+                }
+                target[nextConflict] = source;
+                markConflict(target, nextConflict);
             } else if (options && options.strictMerge) {
-                return [target, source];
+                var conflict = limitedPair(target, source, options);
+                return isArray(conflict) ? markConflict(conflict, 1) : conflict;
             } else if (
                 (options && (options.plainObjects || options.allowPrototypes))
                 || !has.call(Object.prototype, source)
@@ -111,7 +164,7 @@ var merge = function merge(target, source, options) {
                 target[source] = true;
             }
         } else {
-            return [target, source];
+            return limitedPair(target, source, options);
         }
 
         return target;
@@ -143,6 +196,10 @@ var merge = function merge(target, source, options) {
     var mergeTarget = target;
     if (isArray(target) && !isArray(source)) {
         mergeTarget = arrayToObject(target, options);
+        if (isConflict(target)) {
+            // the array may have grown past its last conflict, so continue after its last index
+            markConflict(mergeTarget, target.length - 1);
+        }
     }
 
     if (isArray(target) && isArray(source)) {
@@ -177,7 +234,7 @@ var merge = function merge(target, source, options) {
         }
 
         if (isOverflow(source) && !isOverflow(acc)) {
-            markOverflow(acc, getMaxIndex(source));
+            markOverflow(acc, maxNumericIndex(acc, getMaxIndex(source)));
         }
         if (isOverflow(acc)) {
             var keyNum = parseInt(key, 10);
@@ -185,6 +242,12 @@ var merge = function merge(target, source, options) {
                 setMaxIndex(acc, keyNum);
             }
         }
+        if (isConflict(acc)) {
+            var conflictKey = parseInt(key, 10);
+            if (String(conflictKey) === key && conflictKey > getConflictIndex(acc)) {
+                markConflict(acc, conflictKey);
+            }
+        }
 
         return acc;
     }, mergeTarget);
@@ -198,6 +261,13 @@ var assign = function assignSingleSource(target, source) {
 };
 
 var decode = function (str, defaultDecoder, charset) {
+    // With no `%` there is no escape to expand, in either charset: `unescape` has
+    // nothing to match, and `decodeURIComponent` is the identity on such a string
+    // (and cannot throw). So only `+` -> ' ' remains, and often not even that.
+    if (typeof str === 'string' && str.indexOf('%') === -1) {
+        return str.indexOf('+') === -1 ? str : str.replace(/\+/g, ' ');
+    }
+
     var strWithoutPlus = str.replace(/\+/g, ' ');
     if (charset === 'iso-8859-1') {
         // unescape never throws, no try...catch needed:
@@ -211,6 +281,57 @@ var decode = function (str, defaultDecoder, charset) {
     }
 };
 
+var hasToPrimitive = typeof Symbol === 'function' && typeof Symbol.toPrimitive === 'symbol';
+var arrayJoin = Array.prototype.join;
+var arrayToString = Array.prototype.toString;
+var objectToString = Object.prototype.toString;
+
+// an object with no callable toString (eg, from JSON, or null-prototype) would make String() or join() throw,
+// so it becomes its primitive valueOf or else Object.prototype.toString; arrays are walked like join walks them,
+// copied only once an element changes, with an array already being joined becoming '' as engines do for cycles
+var toCoercible = function toCoercible(value, joining) {
+    if (!value || (typeof value !== 'object' && typeof value !== 'function')) {
+        return value;
+    }
+    if (hasToPrimitive && value[Symbol.toPrimitive] != null) {
+        return value;
+    }
+    if (isArray(value) && value.toString === arrayToString && value.join === arrayJoin) {
+        var ancestors = joining || getSideChannel();
+        if (ancestors.has(value)) {
+            return '';
+        }
+        ancestors.set(value, true);
+        var copy;
+        for (var i = 0; i < value.length; i += 1) {
+            var item = value[i];
+            var coerced = toCoercible(item, ancestors);
+            if (!copy && coerced !== item) {
+                copy = [];
+                for (var j = 0; j < i; j += 1) {
+                    copy[j] = value[j];
+                }
+            }
+            if (copy) {
+                copy[i] = coerced;
+            }
+        }
+        ancestors['delete'](value);
+        return copy || value;
+    }
+    if (typeof value.toString === 'function') {
+        return value;
+    }
+    var valueOf = value.valueOf;
+    if (typeof valueOf === 'function') {
+        var primitive = valueOf.call(value);
+        if (!primitive || (typeof primitive !== 'object' && typeof primitive !== 'function')) {
+            return String(primitive);
+        }
+    }
+    return objectToString.call(value);
+};
+
 var limit = 1024;
 
 /* eslint operator-linebreak: [2, "before"] */
@@ -226,13 +347,15 @@ var encode = function encode(str, defaultEncoder, charset, kind, format) {
     if (typeof str === 'symbol') {
         string = Symbol.prototype.toString.call(str);
     } else if (typeof str !== 'string') {
-        string = String(str);
+        string = String(toCoercible(str));
     }
 
     if (charset === 'iso-8859-1') {
+        // `escape` leaves `+` untouched, but a literal `+` is decoded back to a space,
+        // so it must be percent-encoded to round-trip (the utf-8 path already does this).
         return escape(string).replace(/%u[0-9a-f]{4}/gi, function ($0) {
             return '%26%23' + parseInt($0.slice(2), 16) + '%3B';
-        });
+        }).replace(/\+/g, '%2B');
     }
 
     var out = '';
@@ -384,5 +507,6 @@ module.exports = {
     isRegExp: isRegExp,
     markOverflow: markOverflow,
     maybeMap: maybeMap,
-    merge: merge
+    merge: merge,
+    toCoercible: toCoercible
 };

package/node_modules/qs/package.json

@@ -2,7 +2,7 @@
     "name": "qs",
     "description": "A querystring parser that supports nesting and arrays, with a depth limit",
     "homepage": "https://github.com/ljharb/qs",
-    "version": "6.16.0",
+    "version": "6.16.1",
     "repository": {
         "type": "git",
         "url": "https://github.com/ljharb/qs.git"
@@ -37,13 +37,13 @@
     "devDependencies": {
         "@browserify/envify": "^6.0.0",
         "@browserify/uglifyify": "^6.0.0",
-        "@ljharb/eslint-config": "^22.2.4",
+        "@ljharb/eslint-config": "^22.2.5",
         "browserify": "^16.5.2",
         "bundle-collapser": "^1.4.0",
         "common-shakeify": "~1.0.0",
         "eclint": "^2.8.1",
         "es-value-fixtures": "^1.7.1",
-        "eslint": "^10.9.0",
+        "eslint": "^10.12.0",
         "evalmd": "^0.0.22",
         "for-each": "^0.3.5",
         "glob": "=10.3.7",
@@ -65,7 +65,7 @@
         "qs-iconv": "^1.0.4",
         "safe-publish-latest": "^2.0.0",
         "safer-buffer": "^2.1.2",
-        "tape": "^5.10.2",
+        "tape": "^5.10.3",
         "unassertify": "^3.0.1"
     },
     "scripts": {

package/node_modules/qs/test/parse.js

@@ -62,10 +62,39 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('comma: `[]=` in a value does not wrap the value in an extra array', function (st) {
+        st.deepEqual(qs.parse('a[b]=1,2,3[]=x', { comma: true }), { a: { b: ['1', '2', '3[]=x'] } });
+        st.deepEqual(qs.parse('a[b]=1,2[]=3', { comma: true }), { a: { b: ['1', '2[]=3'] } });
+        st.deepEqual(qs.parse('a[]=1,2,3', { comma: true }), { a: [['1', '2', '3']] });
+        st.end();
+    });
+
     t.test('allows enabling dot notation', function (st) {
         st.deepEqual(qs.parse('a.b=c'), { 'a.b': 'c' });
         st.deepEqual(qs.parse('a.b=c', { allowDots: true }), { a: { b: 'c' } });
 
+        // a literal dot inside a bracket segment must not be rewritten by allowDots (#617)
+        st.deepEqual(
+            qs.parse('outer[a.b]=1', { allowDots: true }),
+            { outer: { 'a.b': '1' } },
+            'a dot inside brackets stays part of the key when allowDots is true'
+        );
+        st.deepEqual(
+            qs.parse('outer[a.b]=1', { allowDots: true }),
+            qs.parse('outer[a.b]=1', { allowDots: false }),
+            'allowDots does not change how a bracket segment containing a dot is parsed'
+        );
+        st.deepEqual(
+            qs.parse('a].b=c', { allowDots: true }),
+            { 'a]': { b: 'c' } },
+            'a stray close bracket does not stop a later dot from being converted'
+        );
+        st.deepEqual(
+            qs.parse('a]].b[c.d]=e', { allowDots: true }),
+            { 'a]]': { b: { 'c.d': 'e' } } },
+            'stray close brackets do not unbalance a later bracket segment'
+        );
+
         st.end();
     });
 
@@ -360,6 +389,14 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('currently moves the key/value split to a later `]=` when the first `=` comes before any bracket group', function (st) {
+        characterizeParse(st, 'a=b[c]=d', undefined, { 'a=b': { c: 'd' } }, 'literal brackets after the first `=`');
+        characterizeParse(st, 'q=%5B1%5D=2', undefined, { 'q=': ['2'] }, 'encoded brackets collapse to an array');
+        characterizeParse(st, 'role=guest%5Bx%5Dy%5D=z', undefined, { 'role=guest': { x: 'z' } }, 'group opens after the first `=`, and the text after it is dropped');
+        characterizeParse(st, 'role=guest%5D=admin', undefined, { 'role=guest]': 'admin' }, 'encoded `]=` with no bracket group at all');
+        st.end();
+    });
+
     t.test('allows to specify array indices', function (st) {
         st.deepEqual(qs.parse('a[1]=c&a[0]=b&a[2]=d'), { a: ['b', 'c', 'd'] });
         st.deepEqual(qs.parse('a[1]=c&a[0]=b'), { a: ['b', 'c'] });
@@ -745,6 +782,38 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('does not mutate an object input', function (st) {
+        var arr = ['x'];
+        st.deepEqual(qs.parse({ a: arr, 'a[]': 'y' }), { a: ['x', 'y'] }, 'appends to a copy of an input array');
+        st.deepEqual(arr, ['x'], 'the input array is unchanged');
+
+        var nested = { b: ['x'] };
+        st.deepEqual(qs.parse({ a: nested, 'a[b][]': 'y' }), { a: { b: ['x', 'y'] } }, 'appends to a copy of a nested input array');
+        st.deepEqual(nested, { b: ['x'] }, 'the nested input array is unchanged');
+
+        var obj = { b: 'c' };
+        st.deepEqual(qs.parse({ a: obj, 'a[d]': 'e' }), { a: { b: 'c', d: 'e' } }, 'merges into a copy of an input object');
+        st.deepEqual(obj, { b: 'c' }, 'the input object is unchanged');
+
+        var sparse = { b: [1, undefined, 2] };
+        st.deepEqual(qs.parse({ a: sparse }), { a: { b: [1, 2] } }, 'compacts a copy of an input array');
+        st.deepEqual(sparse, { b: [1, undefined, 2] }, 'the input array is not compacted');
+
+        var nullProto = { __proto__: null, b: 'c' };
+        st.equal(Object.getPrototypeOf(qs.parse({ a: nullProto }).a), null, 'a null-prototype input object stays null-prototype');
+
+        var date = new Date(0);
+        st.equal(qs.parse({ a: date }).a, date, 'a non-plain object is not copied');
+
+        var cyclic = { b: 'c' };
+        cyclic.self = cyclic;
+        var result = qs.parse({ a: cyclic });
+        st.notEqual(result.a, cyclic, 'a cyclic input object is copied');
+        st.equal(result.a.self, result.a, 'the copy keeps the cycle');
+
+        st.end();
+    });
+
     t.test('does not blow up when Buffer global is missing', function (st) {
         var restore = mockProperty(global, 'Buffer', { 'delete': true });
 
@@ -962,6 +1031,38 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('strictMerge conflicts do not overwrite indexed values already at that path', function (st) {
+        st.deepEqual(
+            qs.parse('a[z]=o&a=p&a[y]=q&a[2]=keep&[a]=r'),
+            { a: { 0: { z: 'o' }, 1: 'p', 2: 'keep', 3: 'r', y: 'q' } },
+            'an indexed key merged into the container is kept'
+        );
+
+        st.deepEqual(
+            qs.parse('a[z]=o&a=p&a[2]=keep&a[y]=q&[a]=r'),
+            { a: { 0: { z: 'o' }, 1: 'p', 2: 'keep', 3: 'r', y: 'q' } },
+            'an indexed key that extended the container while it was an array is kept'
+        );
+
+        st.end();
+    });
+
+    t.test('strictMerge conflicts do not overwrite values once the container overflows', function (st) {
+        st.deepEqual(
+            qs.parse('a[z]=v0&a=v1&a[y]=v2&[a]=v3&[a]x=v4&a[2]=v5&[a]x1=v6', { arrayLimit: 2 }),
+            { a: { 0: { z: 'v0' }, 1: 'v1', 2: ['v3', 'v5'], 3: 'v4', 4: 'v6', y: 'v2' } },
+            'a conflict appended after the container overflowed keeps every value'
+        );
+
+        st.deepEqual(
+            qs.parse('a[2]=v1&a=v5&a=v7&[a]x=v9', { parseArrays: false, arrayLimit: 1 }),
+            { a: { 0: 'v5', 1: 'v7', 2: 'v1', 3: 'v9' } },
+            'an index the container already holds is not reused'
+        );
+
+        st.end();
+    });
+
     t.test('dunder proto is ignored', function (st) {
         var payload = 'categories[__proto__]=login&categories[__proto__]&categories[length]=42';
         var result = qs.parse(payload, { allowPrototypes: true });
@@ -1463,6 +1564,57 @@ test('parse()', function (t) {
             sst.end();
         });
 
+        st.test('enforces arrayLimit when a strictMerge conflict appends to its container', function (sst) {
+            var aliased = 'a[z]=o&a=p&a[y]=q&[a]=r';
+            sst['throws'](
+                function () { qs.parse(aliased, { arrayLimit: 2, throwOnLimitExceeded: true }); },
+                new RangeError('Array limit exceeded. Only 2 elements allowed in an array.'),
+                'a third conflicting value throws once the container would exceed arrayLimit'
+            );
+            sst.deepEqual(
+                qs.parse(aliased, { arrayLimit: 3, throwOnLimitExceeded: true }),
+                { a: { 0: { z: 'o' }, 1: 'p', 2: 'r', y: 'q' } },
+                'appends while the container stays within arrayLimit'
+            );
+            sst.deepEqual(
+                qs.parse(aliased, { arrayLimit: 2 }),
+                { a: { 0: { z: 'o' }, 1: 'p', 2: 'r', y: 'q' } },
+                'appends without throwing when throwOnLimitExceeded is not set'
+            );
+
+            sst.end();
+        });
+
+        st.test('enforces arrayLimit when differently spelled keys collide', function (sst) {
+            sst['throws'](
+                function () { qs.parse('[a]=x&a=y', { arrayLimit: 1, throwOnLimitExceeded: true }); },
+                new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
+                'two primitives throw, as `a=x&a=y` does'
+            );
+            sst['throws'](
+                function () { qs.parse('a[b]=x&a=y', { arrayLimit: 1, throwOnLimitExceeded: true }); },
+                new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
+                'an object and a primitive throw under strictMerge'
+            );
+            sst.deepEqual(
+                qs.parse('[a]=x&a=y', { arrayLimit: 1 }),
+                { a: { 0: 'x', 1: 'y' } },
+                'without throwOnLimitExceeded, two primitives convert to an object, as `a=x&a=y` does'
+            );
+            sst.deepEqual(
+                qs.parse('a[b]=x&a=y', { arrayLimit: 1 }),
+                { a: { 0: { b: 'x' }, 1: 'y' } },
+                'and so do an object and a primitive'
+            );
+            sst.deepEqual(
+                qs.parse('a[b]=x&a=y', { arrayLimit: 2, throwOnLimitExceeded: true }),
+                { a: [{ b: 'x' }, 'y'] },
+                'a collision within arrayLimit is still an array'
+            );
+
+            sst.end();
+        });
+
         st.test('does not throw when cumulative comma combine stays within arrayLimit', function (sst) {
             var result = qs.parse('a=1,2,3&a=4', { comma: true, arrayLimit: 5, throwOnLimitExceeded: true });
             sst.deepEqual(result, { a: ['1', '2', '3', '4'] }, 'combined array within limit is preserved');
@@ -1807,6 +1959,28 @@ test('`duplicates` option', function (t) {
         st.end();
     });
 
+    t.test('`[]=` in a value does not force combining', function (st) {
+        st.deepEqual(
+            qs.parse('a[b]=1&a[b]=2[]=3', { duplicates: 'last' }),
+            { a: { b: '2[]=3' } },
+            'duplicates last: `[]=` in the value is not a bracketed key'
+        );
+
+        st.deepEqual(
+            qs.parse('a[b]=1&a[b]=2[]=3', { duplicates: 'first' }),
+            { a: { b: '1' } },
+            'duplicates first: `[]=` in the value is not a bracketed key'
+        );
+
+        st.deepEqual(
+            qs.parse('a[b]=1&a[b]=2[]=3', { duplicates: 'combine' }),
+            { a: { b: ['1', '2[]=3'] } },
+            'duplicates combine: still combines'
+        );
+
+        st.end();
+    });
+
     t.end();
 });