bare-url 2.5.1 → 2.5.3

package/lib/url-search-params.js

@@ -1,27 +1,31 @@
-const binding = require('../binding')
-
 const kind = Symbol.for('bare.url.search-params.kind')
 
-class URLSearchParams {
-  static _urls = new WeakMap()
+// The URL each instance writes back to, if any. Kept module private so that the
+// setter it drives cannot be pointed at an arbitrary object.
+const urls = new WeakMap()
 
+class URLSearchParams {
   static get [kind]() {
     return 0 // Compatibility version
   }
 
   // https://url.spec.whatwg.org/#dom-urlsearchparams-urlsearchparams
   constructor(init, url = null) {
-    this._params = new Map()
+    this._params = null
 
-    if (url) URLSearchParams._urls.set(this, url)
+    if (url) urls.set(this, url)
 
     if (typeof init === 'string') {
       this._parse(init)
-    } else if (init) {
-      for (const [name, value] of typeof init[Symbol.iterator] === 'function'
-        ? init
-        : Object.entries(init)) {
-        this.append(name, value)
+    } else {
+      this._params = new Map()
+
+      if (init) {
+        for (const [name, value] of typeof init[Symbol.iterator] === 'function'
+          ? init
+          : Object.entries(init)) {
+          this.append(name, value)
+        }
       }
     }
   }
@@ -138,7 +142,7 @@ class URLSearchParams {
 
   // https://url.spec.whatwg.org/#concept-urlsearchparams-update
   _update() {
-    const url = URLSearchParams._urls.get(this)
+    const url = urls.get(this)
 
     if (url === undefined) return
 
@@ -147,41 +151,51 @@ class URLSearchParams {
 
   // https://url.spec.whatwg.org/#concept-urlencoded-parser
   _parse(input) {
-    if (input[0] === '?') input = input.substring(1)
+    const params = new Map()
 
-    this._params = new Map()
+    this._params = params
 
-    for (let sequence of input.split('&')) {
-      if (sequence.length === 0) continue
+    const len = input.length
 
-      sequence = sequence.replace(/\+/g, ' ')
+    let start = input.charCodeAt(0) === 0x3f /* ? */ ? 1 : 0
 
-      let i = sequence.indexOf('=')
-      if (i === -1) i = sequence.length
+    while (start < len) {
+      let end = input.indexOf('&', start)
+      if (end === -1) end = len
 
-      const name = decodeURIComponent(sequence.substring(0, i))
-      const value = decodeURIComponent(sequence.substring(i + 1, sequence.length))
+      if (end !== start) {
+        let split = input.indexOf('=', start)
+        if (split === -1 || split > end) split = end
 
-      let list = this._params.get(name)
+        const name = decode(input.slice(start, split))
+        const value = split === end ? '' : decode(input.slice(split + 1, end))
+
+        const list = params.get(name)
 
-      if (list === undefined) {
-        list = []
-        this._params.set(name, list)
+        if (list === undefined) params.set(name, [value])
+        else list.push(value)
       }
 
-      list.push(value)
+      start = end + 1
     }
   }
 
   // https://url.spec.whatwg.org/#concept-urlencoded-serializer
   _serialize() {
-    const pairs = []
+    let result = ''
+    let separator = ''
 
     for (const [name, values] of this._params) {
-      for (const value of values) pairs.push(String(name), String(value))
+      // The name is shared by all of its values, so it is only encoded once.
+      const encoded = encode(String(name))
+
+      for (const value of values) {
+        result += separator + encoded + '=' + encode(String(value))
+        separator = '&'
+      }
     }
 
-    return binding.serializeSearchParams(pairs)
+    return result
   }
 }
 
@@ -192,3 +206,71 @@ exports.isURLSearchParams = function isURLSearchParams(value) {
 
   return typeof value === 'object' && value !== null && value[kind] === URLSearchParams[kind]
 }
+
+// https://url.spec.whatwg.org/#concept-urlencoded-byte-serializer
+//
+// Everything except ASCII alphanumerics and `*-._` is percent-encoded, and a
+// space becomes `+` rather than `%20`. Names and values usually consist entirely
+// of characters that are left alone, so a component is tested as a whole before
+// any of it is rewritten.
+const unencoded = /^[\w*.-]*$/
+
+// As above, but allowing spaces, which need nothing more than turning into `+`.
+// Spaces are by far the most common reason for a component to need rewriting at
+// all, so recognizing them here spares those components a trip through
+// encodeURIComponent().
+const spaced = /^[\w*. -]*$/
+
+// The characters that encodeURIComponent() leaves alone but the urlencoded byte
+// serializer does not. Two patterns are needed because a global regular
+// expression cannot be shared between test() and replace(), as test() advances
+// its lastIndex.
+const extra = /[!'()~]/
+const extraAll = /[!'()~]/g
+
+const escapes = {
+  '!': '%21',
+  "'": '%27',
+  '(': '%28',
+  ')': '%29',
+  '~': '%7E'
+}
+
+// A surrogate pair, or a surrogate that is not part of one and so encodes no
+// scalar value. Pairs are matched first so that only the capture group can hold
+// a lone surrogate; a lookbehind would say this more directly but isn't
+// supported by every engine.
+const lone = /[\ud800-\udbff][\udc00-\udfff]|([\ud800-\udbff]|[\udc00-\udfff])/g
+
+function encode(component) {
+  if (unencoded.test(component)) return component
+
+  if (spaced.test(component)) return component.replaceAll(' ', '+')
+
+  let encoded
+
+  try {
+    encoded = encodeURIComponent(component)
+  } catch {
+    // encodeURIComponent() rejects lone surrogates, whereas the UTF-8 encoder the
+    // serializer is defined in terms of replaces them with U+FFFD.
+    encoded = encodeURIComponent(
+      component.replace(lone, (match, single) => (single === undefined ? match : '\ufffd'))
+    )
+  }
+
+  if (encoded.includes('%20')) encoded = encoded.replaceAll('%20', '+')
+
+  if (extra.test(encoded)) encoded = encoded.replace(extraAll, (match) => escapes[match])
+
+  return encoded
+}
+
+// https://url.spec.whatwg.org/#percent-decode-after-encoding
+function decode(component) {
+  if (component.indexOf('+') !== -1) component = component.replaceAll('+', ' ')
+
+  if (component.indexOf('%') === -1) return component
+
+  return decodeURIComponent(component)
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bare-url",
-  "version": "2.5.1",
+  "version": "2.5.3",
   "description": "WHATWG URL implementation for JavaScript",
   "exports": {
     "./package": "./package.json",