parse-nested-form-data 1.0.0 → 1.1.0

package/dist/parse-nested-form-data.cjs.js

@@ -1,393 +1,602 @@
-'use strict';
-
-Object.defineProperty(exports, '__esModule', { value: true });
-
-var webFile = require('@remix-run/web-file');
-
 /**
  * @name parse-nested-form-data
  * @license MIT license.
  * @copyright (c) 2022 Christian Schurr
  * @author Christian Schurr <chris@schurr.dev>
  */
-
+Object.defineProperties(exports, {
+	__esModule: { value: true },
+	[Symbol.toStringTag]: { value: "Module" }
+});
+// src/errors.ts
 /**
- * Thrown when a path is used multiple times or has missmatching path parts.
- *
- * @example
- * ```ts
- * const formData = new FormData()
- * formData.append('a[0]', 'b')
- * formData.append('a[0]', 'c')
- * parseFormData(formData)
- * // throws DuplicateKeyError('a[0]')
- * ```
- *
- * @example
- * ```ts
- * const formData = new FormData()
- * formData.append('a', 'b')
- * formData.append('a', 'c')
- * parseFormData(formData)
- * // throws DuplicateKeyError('a')
- *
- * @example
- * ```ts
- * const formData = new FormData()
- * formData.append('a', 'b')
- * formData.append('a[]', 'c')
- * parseFormData(formData)
- * // throws DuplicateKeyError('a[]')
- * ```
- *
- */
-class DuplicateKeyError extends Error {
-  constructor(key) {
-    super(`Duplicate key at path part ${key}`);
-    this.key = void 0;
-    this.key = key;
-  }
+* Thrown when a path is used multiple times or has mismatching path parts.
+*
+* @example
+* ```ts
+* const formData = new FormData()
+* formData.append('a[0]', 'b')
+* formData.append('a[0]', 'c')
+* parseFormData(formData)
+* // throws DuplicateKeyError('a[0]')
+* ```
+*
+* @example
+* ```ts
+* const formData = new FormData()
+* formData.append('a', 'b')
+* formData.append('a', 'c')
+* parseFormData(formData)
+* // throws DuplicateKeyError('a')
+* ```
+*
+* @example
+* ```ts
+* const formData = new FormData()
+* formData.append('a', 'b')
+* formData.append('a[]', 'c')
+* parseFormData(formData)
+* // throws DuplicateKeyError('a[]')
+* ```
+*
+*/
+var DuplicateKeyError = class extends Error {
+	constructor(key) {
+		super(`Duplicate key at path part ${key}`);
+		this.name = "DuplicateKeyError";
+		this.key = key;
+	}
+};
+/**
+* Thrown when an array is used at the same path with an order parameter and
+* without an order parameter.
+*
+* @example
+* ```ts
+* const formData = new FormData()
+* formData.append('a[0]', 'a')
+* formData.append('a[]', 'b')
+* parseFormData(formData)
+* // => throws `MixedArrayError(a[])`
+* ```
+*
+* @example
+* ```ts
+* const formData = new FormData()
+* formData.append('a[]', 'a')
+* formData.append('a[0]', 'b')
+* parseFormData(formData)
+* // => throws `MixedArrayError(a[0])`
+* ```
+*/
+var MixedArrayError = class extends Error {
+	constructor(key) {
+		super(`Mixed array at path part ${key}`);
+		this.name = "MixedArrayError";
+		this.key = key;
+	}
+};
+/**
+* Cuts a path to 100 characters plus `...`, so a huge path from a client
+* doesn't end up in full in logs or error responses.
+*/
+function shortKey(key) {
+	return key.length > 100 ? `${key.slice(0, 100)}...` : key;
 }
 /**
- * Thrown when an array is used at the same path with an order parameter and
- * without an order parameter.
- *
- * @example
- * ```ts
- * const formData = new FormData()
- * formData.append('a[0]', 'a')
- * formData.append('a[]', 'b')
- * parseFormData(formData)
- * // => throws `MixedArrayError(a[])`
- * ```
- *
- * @example
- * ```ts
- * const formData = new FormData()
- * formData.append('a[]', 'a')
- * formData.append('a[0]', 'b')
- * parseFormData(formData)
- * // => throws `MixedArrayError(a[0])`
- * ```
- */
-class MixedArrayError extends Error {
-  constructor(key) {
-    super(`Mixed array at path part ${key}`);
-    this.key = void 0;
-    this.key = key;
-  }
+* Thrown when an object path part is `__proto__`, `constructor` or
+* `prototype`, which could modify `Object.prototype`. The names are rejected
+* at any position in the path. Entries with other names on `Object.prototype`
+* (`toString`, ...) are removed instead (see `parseFormData`).
+* `key` is the path up to the forbidden part, cut to 100 characters plus `...`
+* when it's longer.
+*
+* @example
+* ```ts
+* const formData = new FormData()
+* formData.append('__proto__.polluted', 'yes')
+* parseFormData(formData)
+* // throws ForbiddenKeyError('__proto__')
+* ```
+*/
+var ForbiddenKeyError = class extends Error {
+	constructor(key) {
+		key = shortKey(key);
+		super(`Forbidden key at path part ${key}`);
+		this.name = "ForbiddenKeyError";
+		this.key = key;
+	}
+};
+/**
+* Thrown when a path has more path parts than the `depth` option allows.
+* `key` is the path up to the first path part over the limit, cut to
+* 100 characters plus `...` when it's longer.
+* Within one entry the depth is checked first, so a path that's too deep throws
+* `DepthLimitError` even if it would also throw another error, like a
+* `ForbiddenKeyError` for `__proto__`.
+*
+* @example
+* ```ts
+* const formData = new FormData()
+* formData.append('a.b[0].c', 'x')
+* parseFormData(formData, {depth: 2})
+* // throws DepthLimitError('a.b[0]')
+* ```
+*/
+var DepthLimitError = class extends Error {
+	constructor(key) {
+		key = shortKey(key);
+		super(`Depth limit exceeded at path part ${key}`);
+		this.name = "DepthLimitError";
+		this.key = key;
+	}
+};
+/**
+* Thrown when an array index in a path is larger than `4294967294`, the
+* largest index a JavaScript array can hold.
+* `key` is the path up to that array part, cut to 100 characters plus `...`
+* when it's longer.
+*
+* @example
+* ```ts
+* const formData = new FormData()
+* formData.append('a[4294967295]', 'b')
+* parseFormData(formData)
+* // throws InvalidPathError('a[4294967295]')
+* ```
+*/
+var InvalidPathError = class extends Error {
+	constructor(key) {
+		key = shortKey(key);
+		super(`Invalid path at path part ${key}`);
+		this.name = "InvalidPathError";
+		this.key = key;
+	}
+};
+// src/path-parts.ts
+/**
+* Finds the `]` that ends the bracket part starting at the `[` at `open`.
+* Returns -1 if this `[` is not a bracket part but a normal character of the key.
+*
+* Brackets can be nested: in `a[b[c]]` the last `]` belongs to
+* the first `[`.
+*
+* Special cases:
+* - Some `[` are never closed. The part then ends at the last `]`:
+*   `a[[0]` => key `[0`.
+* - If there is no `]` after the `[` at all, the `[` is a normal character:
+*   `a[0` => key `a[0`.
+* - The same goes for a `]` without a `[`: `a]b` => key `a]b`, and
+*   `a[b]]` => key `]` inside `b`.
+*
+* The scan stops at the returned `]`. The caller continues from there, so no
+* character of the path is scanned twice.
+*/
+function closeOf(path, open, lastClose) {
+	if (open > lastClose) return -1;
+	let nesting = 0;
+	for (let idx = open; idx < lastClose; idx++) if (path[idx] === "[") nesting++;
+	else if (path[idx] === "]" && --nesting === 0) return idx;
+	return lastClose;
 }
-function isJsonObject(val) {
-  return typeof val === 'object' && !Array.isArray(val) && val !== null && !(val instanceof webFile.File);
+/**
+*
+* Transforms a FormData path into an array of `PathPart`s.
+*
+* @param path - the path to extract the path parts from
+* @param depth - the maximum number of path parts (default: `Infinity`)
+* @returns {Array<PathPart>} the extracted path parts
+* @throws `DepthLimitError` if the path has more path parts than `depth`, at
+* the first part over the limit
+*
+* @example
+* ```ts
+* const path = 'a[0].b'
+* const result = extractPathParts(path)
+* // => [{path: 'a', type: 'object', default: [], pathToPart: 'a'},
+* //     {path: '0', type: 'array', default: {}, pathToPart: 'a[0]'},
+* //     {path: 'b', type: 'object', default: {}, pathToPart: 'a[0].b'}]
+* ```
+*
+* @example
+* ```ts
+* const path = 'a.b'
+* const result = extractPathParts(path)
+* // => [{path: 'a', type: 'object', default: {}, pathToPart: 'a'},
+* //     {path: 'b', type: 'object', default: {}, pathToPart: 'a.b'}]
+* ```
+*
+* @example
+* ```ts
+* const path = 'a[b][0]'
+* const result = extractPathParts(path)
+* // => [{path: 'a', type: 'object', default: {}, pathToPart: 'a'},
+* //     {path: 'b', type: 'object', default: [], pathToPart: 'a[b]'},
+* //     {path: '0', type: 'array', default: {}, pathToPart: 'a[b][0]'}]
+* ```
+*
+* @example
+* ```ts
+* const path = 'a[][0]'
+* const result = extractPathParts(path)
+* // => [{path: 'a', type: 'object', default: [], pathToPart: 'a'},
+* //     {path: '', type: 'array', default: [], pathToPart: 'a[]'},
+* //     {path: '0', type: 'array', default: {}, pathToPart: 'a[][0]'}]
+* ```
+*
+*
+*/
+function extractPathParts(path, depth = Infinity) {
+	const lastClose = path.lastIndexOf("]");
+	const parts = [];
+	const addPart = (key, type, end) => {
+		if (key === "" && type === "object") return;
+		if (parts.length === depth) throw new DepthLimitError(path.slice(0, end));
+		parts.push({
+			path: key,
+			type,
+			default: {},
+			pathToPart: path.slice(0, end)
+		});
+	};
+	let start = 0;
+	for (let idx = 0; idx < path.length; idx++) {
+		const close = path[idx] === "[" ? closeOf(path, idx, lastClose) : -1;
+		if (path[idx] !== "." && close < idx) continue;
+		addPart(path.slice(start, idx), "object", idx);
+		if (close > idx) {
+			const key = path.slice(idx + 1, close);
+			addPart(key, /^\d*$/.test(key) ? "array" : "object", close + 1);
+			idx = close;
+		}
+		start = idx + 1;
+	}
+	addPart(path.slice(start), "object", path.length);
+	parts.forEach((part, idx) => {
+		if (parts[idx + 1]?.type === "array") part.default = [];
+	});
+	return parts;
 }
-
+// src/transform.ts
 /**
- * Default Transformer for `parseFormData`.
- *
- * Transforms a FormData Entry into a path and a `JsonLeafValue`.
- *
- * - `path` starts with `+` -> transform value to `number`
- * - `path` starts with `&` -> transform value to `boolean`
- * - `path` starts with `-` -> transform value to `null`
- *
- * @example
- * ```ts
- * const entry = ['a[0]', 'b']
- * const result = defaultTransform(entry)
- * // => {path: 'a[0]', value: 'b'}
- * ```
- *
- * @example
- * ```ts
- * const entry = ['+a[0]', '1']
- * const result = defaultTransform(entry)
- * // => {path: 'a[0]', value: 1}
- * ```
- *
- * @example
- * ```ts
- * const entry = ['&a[0]', 'true']
- * const result = defaultTransform(entry)
- * // => {path: 'a[0]', value: true}
- * ```
- *
- * @example
- * ```ts
- * const entry = ['-a[0]', 'null']
- * const result = defaultTransform(entry)
- * // => {path: 'a[0]', value: null}
- * ```
- *
- * @example
- * ```ts
- * const entry = ['a[0]', new File([''], 'file.txt')]
- * const result = defaultTransform(entry)
- * // => {path: 'a[0]', value: File}
- * ```
- *
- *
- * @param entry [path, value]: the FormData entry
- * @returns the path and the transformed value
- */
+* Default Transformer for `parseFormData`.
+*
+* Transforms a FormData Entry into a path and a `JsonLeafValue`.
+*
+* - `path` starts with `+` -> transform value to `number`
+* - `path` starts with `&` -> transform value to `boolean`
+* - `path` starts with `-` -> transform value to `null`
+*
+* @example
+* ```ts
+* const entry = ['a[0]', 'b']
+* const result = defaultTransform(entry)
+* // => {path: 'a[0]', value: 'b'}
+* ```
+*
+* @example
+* ```ts
+* const entry = ['+a[0]', '1']
+* const result = defaultTransform(entry)
+* // => {path: 'a[0]', value: 1}
+* ```
+*
+* @example
+* ```ts
+* const entry = ['&a[0]', 'true']
+* const result = defaultTransform(entry)
+* // => {path: 'a[0]', value: true}
+* ```
+*
+* @example
+* ```ts
+* const entry = ['-a[0]', 'null']
+* const result = defaultTransform(entry)
+* // => {path: 'a[0]', value: null}
+* ```
+*
+* @example
+* ```ts
+* const entry = ['a[0]', new File([''], 'file.txt')]
+* const result = defaultTransform(entry)
+* // => {path: 'a[0]', value: File}
+* ```
+*
+*
+* @param entry [path, value]: the FormData entry
+* @returns the path and the transformed value
+*/
 function defaultTransform(entry) {
-  let path = entry[0];
-  let value = entry[1];
-  if (path.startsWith('+')) {
-    path = path.slice(1);
-    value = Number(value);
-  } else if (path.startsWith('&')) {
-    path = path.slice(1);
-    value = value === 'on' || value === 'true' || Boolean(Number(value));
-  } else if (path.startsWith('-')) {
-    path = path.slice(1);
-    value = null;
-  }
-  return {
-    path,
-    value
-  };
+	let path = entry[0];
+	let value = entry[1];
+	if (path.startsWith("+")) {
+		path = path.slice(1);
+		value = Number(value);
+	} else if (path.startsWith("&")) {
+		path = path.slice(1);
+		value = value === "on" || value === "true" || Boolean(Number(value));
+	} else if (path.startsWith("-")) {
+		path = path.slice(1);
+		value = null;
+	}
+	return {
+		path,
+		value
+	};
+}
+// src/index.ts
+const FORBIDDEN_OBJECT_KEYS = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+const MAX_ARRAY_INDEX = 4294967294;
+function isPrototypeKey(key) {
+	return Object.getOwnPropertyDescriptor(Object.prototype, key) !== void 0;
 }
 /**
- *
- * Transforms a FormData path into an array of `PathPart`s.
- *
- * @param path - the path to extract the path parts from
- * @returns {Array<PathPart>} the extracted path parts
- *
- * @example
- * ```ts
- * const path = 'a[0].b'
- * const result = extractPathParts(path)
- * // => [{path: 'a', type: 'object, default: [], pathToPart: 'a'},
- * //     {path: '0', type: 'array', default: {}, pathToPart: 'a[0]'},
- * //     {path: 'b', type: 'object', default: {}, pathToPart: 'a[0].b'}]
- * ```
- *
- * @example
- * ```ts
- * const path = 'a.b'
- * const result = extractPathParts(path)
- * // => [{path: 'a', type: 'object, default: {}, pathToPart: 'a'},
- * //     {path: 'b', type: 'object', default: {}, pathToPart: 'a.b'}]
- * ```
- *
- * @example
- * ```ts
- * const path = 'a[][0]'
- * const result = extractPathParts(path)
- * // => [{path: 'a', type: 'object, default: [], pathToPart: 'a'},
- * //     {path: '', type: 'array', default: [], pathToPart: 'a[]'},
- * //     {path: '0', type: 'array', default: {}, pathToPart: 'a[][0]'}]
- * ```
- *
- *
- */
-function extractPathParts(path) {
-  const re = /((?<array>\d*)\]|(?<pathPart>[^.[]+))(?<nextType>\[|\.|$)/g;
-  return Array.from(path.matchAll(re)).map(match => {
-    // self casted RegexExpMatchArray to custom
-    const typedMatch = match;
-    const {
-      array,
-      pathPart,
-      nextType
-    } = typedMatch.groups;
-    const type = array === undefined ? 'object' : 'array';
-    const nextDefault = nextType === '[' ? [] : {};
-    return {
-      path: array ?? pathPart,
-      type,
-      default: nextDefault,
-      pathToPart: path.slice(0, typedMatch.index + typedMatch[1].length)
-    };
-  });
+* Detects `File` and `Blob` values by their `Symbol.toStringTag`, which works
+* for native instances, polyfills (e.g. `@remix-run/web-file`) and values from
+* other realms, where `instanceof` would fail.
+*/
+function isFileLike(val) {
+	const tag = Object.prototype.toString.call(val);
+	return tag === "[object File]" || tag === "[object Blob]";
+}
+function isJsonObject(val) {
+	return typeof val === "object" && !Array.isArray(val) && val !== null && !isFileLike(val);
 }
-
 /**
- *
- * Returns the value accessed via `pathPart` in the `currentPathObject`
- * and a setter function to set the value in the `currentPathObject` via the
- * provided `pathPart`.
- *
- * @param pathPart - the path part to get the setter and getter for
- * @param currentPathObject - the object at the current path (before the path part)
- * @param arraysWithOrder - a set of arrays that have an order
- * @returns the setter and getter for the path part
- *
- * @example
- * ```ts
- * const pathPart = {path: 'a', type: 'object', default: {}, pathToPart: 'a'}
- * const currentPathObject = {}
- * const arraysWithOrder = new Set()
- * const [value, setValue] = getSetterAndGetter(pathPart, currentPathObject, arraysWithOrder)
- * setValue('b')
- * // => currentPathObject = {a: 'b'}
- * ```
- *
- * @example
- * ```ts
- * const pathPart = {path: '0', type: 'array', default: [], pathToPart: 'a[0]'}
- * const currentPathObject = {a: []}
- * const arraysWithOrder = new Set()
- * const [value, setValue] = getSetterAndGetter(pathPart, currentPathObject, arraysWithOrder)
- * setValue('b')
- * // => currentPathObject = {a: ['b']}
- * ```
- *
- */
+*
+* Returns the value accessed via `pathPart` in the `currentPathObject`,
+* a setter function to set the value in the `currentPathObject` via the
+* provided `pathPart`, and the key (object key or array index) it uses.
+*
+* @param pathPart - the path part to get the value, setter and key for
+* @param currentPathObject - the object at the current path (before the path part)
+* @param arraysWithOrder - a set of arrays that have an order
+* @returns the current value, a setter for it, and the key (object key or
+* array index) in `currentPathObject`
+*
+* @example
+* ```ts
+* const pathPart = {path: 'a', type: 'object', default: {}, pathToPart: 'a'}
+* const currentPathObject = {}
+* const arraysWithOrder = new Set()
+* const [value, setValue, key] = handlePathPart(pathPart, currentPathObject, arraysWithOrder)
+* setValue('b')
+* // => currentPathObject = {a: 'b'}, key = 'a'
+* ```
+*
+* @example
+* ```ts
+* const pathPart = {path: '0', type: 'array', default: [], pathToPart: 'a[0]'}
+* const currentPathObject = {a: []}
+* const arraysWithOrder = new Set()
+* const [value, setValue, key] = handlePathPart(pathPart, currentPathObject.a, arraysWithOrder)
+* setValue('b')
+* // => currentPathObject = {a: ['b']}, key = 0
+* ```
+*
+*/
 function handlePathPart(pathPart, currentPathObject, arraysWithOrder) {
-  if (pathPart.type === 'object') {
-    if (Array.isArray(currentPathObject)) {
-      throw new DuplicateKeyError(pathPart.pathToPart);
-    }
-    const currentObject = currentPathObject;
-    return [currentObject[pathPart.path], val => currentObject[pathPart.path] = val];
-  }
-  if (!Array.isArray(currentPathObject)) {
-    throw new DuplicateKeyError(pathPart.pathToPart);
-  }
-  const currentArray = currentPathObject;
-  const isOrdered = pathPart.path !== '';
-  const isOrderedArray = arraysWithOrder.has(currentArray);
-  if (isOrdered) {
-    arraysWithOrder.add(currentArray);
-  }
-  if (!isOrdered && isOrderedArray || isOrdered && !isOrderedArray && currentArray.length > 0) {
-    throw new MixedArrayError(pathPart.pathToPart);
-  }
-  const order = isOrdered ? Number(pathPart.path) : currentArray.length;
-  return [currentArray[order], val => currentArray[order] = val];
+	if (pathPart.type === "object") {
+		const key = pathPart.path;
+		if (FORBIDDEN_OBJECT_KEYS.has(key)) throw new ForbiddenKeyError(pathPart.pathToPart);
+		if (Array.isArray(currentPathObject)) throw new DuplicateKeyError(pathPart.pathToPart);
+		const currentObject = currentPathObject;
+		return [
+			Object.prototype.hasOwnProperty.call(currentObject, key) ? currentObject[key] : void 0,
+			(val) => {
+				if (!isPrototypeKey(key)) {
+					currentObject[key] = val;
+					return;
+				}
+				Object.defineProperty(currentObject, key, {
+					value: val,
+					writable: true,
+					enumerable: true,
+					configurable: true
+				});
+			},
+			key
+		];
+	}
+	const isOrdered = pathPart.path !== "";
+	if (isOrdered && Number(pathPart.path) > MAX_ARRAY_INDEX) throw new InvalidPathError(pathPart.pathToPart);
+	if (!Array.isArray(currentPathObject)) throw new DuplicateKeyError(pathPart.pathToPart);
+	const currentArray = currentPathObject;
+	const isOrderedArray = arraysWithOrder.has(currentArray);
+	if (isOrdered) arraysWithOrder.add(currentArray);
+	if (!isOrdered && isOrderedArray || isOrdered && !isOrderedArray && currentArray.length > 0) throw new MixedArrayError(pathPart.pathToPart);
+	const order = isOrdered ? Number(pathPart.path) : currentArray.length;
+	return [
+		currentArray[order],
+		(val) => currentArray[order] = val,
+		order
+	];
 }
-
 /**
- *
- * Parses a FormData object to a JSON object. This is done by parsing the `name`
- * attribute of each `FormDataEntryValue` and then inserting the value at the
- * path. Also by default the start of the path is used to transform the value.
- *
- *
- * In front of the whole `key`:
- *  - `+` => parse to `Number`
- *  - `-` => set value to `null`
- *  - `&` => parse to `Boolean`
- *
- * - `.` between path parts => nest into `objects`
- * - `[\d*]` after path part => push to array in order `\d` or push to end if `[]`
- *
-
- *
- * @example
- * ```ts
- * const formData = new FormData()
- * formData.append('+a', '1')
- * formData.append('&b', 'true')
- * formData.append('-c', 'null')
- * formData.append('d', 'foo')
- * parseFormData(formData, defaultTransform)
- * // => {a: 1, b: true, c: null, d: 'foo'}
- * ```
- *
- * @example
- * ```ts
- * const formData = new FormData()
- * formData.append('a.b', 'foo')
- * parseFormData(formData)
- * // => {a: {b: 'foo'}}
- * ```
- *
- * @example
- * ```ts
- * const formData = new FormData()
- * formData.append('a[0]', 'foo')
- * formData.append('a[1]', 'bar')
- * parseFormData(formData)
- * // => {a: ['foo', 'bar']}
- * ```
- * 
- * @example
- * ```ts
- * const formData = new FormData()
- * formData.append('a[]', 'foo')
- * formData.append('a[]', 'bar')
- * parseFormData(formData)
- * // => {a: ['foo', 'bar']}
- * ```
- * 
- * @example
- * ```ts
- * const formData = new FormData()
- * formData.append('a[0]', 'foo')
- * parseFormData(formData, {transformEntry: (path, value) => {path, value: value + 'bar'}})
- * // => {a: ['foobar']}
- * ```
- * 
- * @example
- * ```ts
- * const formData = new FormData()
- * formData.append('a[0]', 'foo')
- * formData.append('a[1]', '')
- * parseFormData(formData, {removeEmptyString: true})
- * // => {a: ['foo']}
- * ```
- *
- * @param {Iterable<[string, string | File]>} formData - an iterator of an [`path`, `value`] tuple
- * - `path` := `^(\+|\-|\&)?([^\.]+?(\[\d*\])*)(\.[^\.]+?(\[\d*\])*)*$` (e.g. `+a[][1].b`)
- * - `value` := `string` or `File`
- * @param {ParseFormDataOptions} options - options for parsing the form data
- * - `transformEntry` - a function to transform the path and the value before
- *    inserting the value at the path in the resulting object (default: `defaultTransform`)
- * - `removeEmptyString` - if `true` removes all entries where the value is an empty string
- * @returns {JsonObject} the parsed JSON object
- * @throws `DuplicateKeyError` if
- * - a path part is an object and the path part is already defined as an object
- * - a path part is an array and the path part is already defined as an array
- * @throws `MixedArrayError` if at a specific path part an unordered array is 
- * defined and at a later path part an ordered array is defined or vice versa
- * - e.g. `a[0]` and `a[]`
- * - e.g. `a[]` and `a[0]`
- */
-function parseFormData(formData, _temp) {
-  let {
-    removeEmptyString = false,
-    transformEntry = defaultTransform
-  } = _temp === void 0 ? {} : _temp;
-  const result = {};
-
-  // all arrays we need to squash (in place) later
-  const arraysWithOrder = new Set();
-  for (const entry of Array.from(formData)) {
-    if (removeEmptyString && entry[1] === '') continue;
-    const {
-      path,
-      value
-    } = transformEntry(entry, defaultTransform);
-    const pathParts = extractPathParts(path);
-    let currentPathObject = result;
-    pathParts.forEach((pathPart, idx) => {
-      const [nextPathValue, setNextPathValue] = handlePathPart(pathPart, currentPathObject, arraysWithOrder);
-      if (pathParts.length - 1 === idx) {
-        if (nextPathValue !== undefined) {
-          throw new DuplicateKeyError(pathPart.pathToPart);
-        }
-        setNextPathValue(value);
-      } else {
-        if (nextPathValue !== undefined && !isJsonObject(nextPathValue) && !Array.isArray(nextPathValue)) {
-          throw new DuplicateKeyError(pathPart.pathToPart);
-        }
-        const nextPathObject = nextPathValue ?? pathPart.default;
-        currentPathObject = nextPathObject;
-        setNextPathValue(nextPathObject);
-      }
-    });
-  }
-  for (const orderedArray of Array.from(arraysWithOrder)) {
-    // replace array with a squashed array
-    // array.flat(0) will remove all empty slots (e.g. [0, , 1] => [0, 1])
-    orderedArray.splice(0, orderedArray.length, ...orderedArray.flat(0));
-  }
-  return result;
+*
+* Parses a FormData object to a JSON object. This is done by parsing the `name`
+* attribute of each `FormDataEntryValue` and then inserting the value at the
+* path. Also by default the start of the path is used to transform the value.
+*
+*
+* In front of the whole `key`:
+*  - `+` => parse to `Number`
+*  - `-` => set value to `null`
+*  - `&` => parse to `Boolean`
+*
+* - `.` between path parts => nest into `objects`
+* - `[key]` after path part => nest into `objects`, same as `.key`; the text
+*   in brackets is the key as it is (`a[b.c]` => key `b.c`)
+* - `[\d*]` after path part => push to array in order `\d` or push to end if `[]`
+*
+* @example
+* ```ts
+* const formData = new FormData()
+* formData.append('+a', '1')
+* formData.append('&b', 'true')
+* formData.append('-c', 'null')
+* formData.append('d', 'foo')
+* parseFormData(formData)
+* // => {a: 1, b: true, c: null, d: 'foo'}
+* ```
+*
+* @example
+* ```ts
+* const formData = new FormData()
+* formData.append('a.b', 'foo')
+* parseFormData(formData)
+* // => {a: {b: 'foo'}}
+* ```
+*
+* @example
+* ```ts
+* const formData = new FormData()
+* formData.append('a[b]', 'foo')
+* formData.append('a.c', 'bar')
+* parseFormData(formData)
+* // => {a: {b: 'foo', c: 'bar'}}
+* ```
+*
+* @example
+* ```ts
+* const formData = new FormData()
+* formData.append('a[0]', 'foo')
+* formData.append('a[1]', 'bar')
+* parseFormData(formData)
+* // => {a: ['foo', 'bar']}
+* ```
+*
+* @example
+* ```ts
+* const formData = new FormData()
+* formData.append('a[]', 'foo')
+* formData.append('a[]', 'bar')
+* parseFormData(formData)
+* // => {a: ['foo', 'bar']}
+* ```
+*
+* @example
+* ```ts
+* const formData = new FormData()
+* formData.append('a[0]', 'foo')
+* parseFormData(formData, {
+*   transformEntry: ([path, value]) => ({
+*     path,
+*     value: typeof value === 'string' ? value + 'bar' : value,
+*   }),
+* })
+* // => {a: ['foobar']}
+* ```
+*
+* @example
+* ```ts
+* const formData = new FormData()
+* formData.append('a[0]', 'foo')
+* formData.append('a[1]', '')
+* parseFormData(formData, {removeEmptyString: true})
+* // => {a: ['foo']}
+* ```
+*
+* @param {Iterable<[string, string | File]>} formData - an iterator of an [`path`, `value`] tuple
+* - `path` := an optional prefix (`+`, `-`, `&`), then path parts: keys after
+*   `.` or in brackets (`[key]`), and array parts `[]` or `[\d+]` (e.g.
+*   `+a[][1].b[c]`)
+* - `value` := `string` or `File` (native or polyfilled `File` values are kept
+*   as they are)
+* @param {ParseFormDataOptions} options - options for parsing the form data
+* - `transformEntry` - a function to transform the path and the value before
+*    inserting the value at the path in the resulting object (default: `defaultTransform`)
+* - `removeEmptyString` - if `true` removes all entries where the value is an empty string
+* - `depth` - the maximum number of path parts in a path, counting every part
+*   (default: `Infinity`)
+* @returns {JsonObject} the parsed JSON object
+* @throws `TypeError` if `depth` isn't a positive integer or `Infinity`
+* @throws `DepthLimitError` if a path has more path parts than `depth`
+* - e.g. `a.b[0]` with `depth: 2` => `DepthLimitError('a.b[0]')`
+* @throws `DuplicateKeyError` if
+* - two entries set a value at the same path
+*   - e.g. `a` and `a`, `a[0]` and `a[0]`, `a.b` and `a[b]`
+* - an entry uses a path part as an object, array or value and another entry
+*   uses it differently
+*   - e.g. `a` and `a.b`, `a.b` and `a[]`, `a[]` and `a.b`
+* - the path starts with an array part
+*   - e.g. `[0]` or `[]`
+* @throws `MixedArrayError` if at a specific path part an unordered array is
+* defined and at a later path part an ordered array is defined or vice versa
+* - e.g. `a[0]` and `a[]`
+* - e.g. `a[]` and `a[0]`
+* @throws `ForbiddenKeyError` if an object path part is `__proto__`,
+* `constructor` or `prototype`
+* - e.g. `__proto__.polluted`
+* @throws `InvalidPathError` if an array index is larger than `4294967294`
+* - e.g. `a[4294967295]`
+*
+* Every error's `key` is the path after `transformEntry`, not the field name
+* (e.g. `+a.b.c` with `depth: 2` => `DepthLimitError('a.b.c')`).
+*
+* An entry with any other object path part named like a property on
+* `Object.prototype` (`toString`, `hasOwnProperty`, ...) is removed from the
+* result. It's parsed like any other entry first, so it causes the same errors
+* as an unused name: an error doesn't tell the client which properties exist
+* on the server's `Object.prototype`.
+* - e.g. `user.toString` => `{}`
+* - e.g. `user[toString]` => `{}`
+*/
+function parseFormData(formData, { removeEmptyString = false, transformEntry = defaultTransform, depth = Infinity } = {}) {
+	if (depth !== Infinity && !(Number.isInteger(depth) && depth > 0)) throw new TypeError(`depth must be a positive integer or Infinity, got ${String(depth)}`);
+	const result = {};
+	const arraysWithOrder = /* @__PURE__ */ new Set();
+	const createdByRemoved = [];
+	for (const entry of Array.from(formData)) {
+		if (removeEmptyString && entry[1] === "") continue;
+		const { path, value } = transformEntry(entry, defaultTransform);
+		const pathParts = extractPathParts(path, depth);
+		const isRemoved = pathParts.some((pathPart) => pathPart.type === "object" && isPrototypeKey(pathPart.path));
+		let currentPathObject = result;
+		pathParts.forEach((pathPart, idx) => {
+			const [nextPathValue, setNextPathValue, key] = handlePathPart(pathPart, currentPathObject, arraysWithOrder);
+			const parent = currentPathObject;
+			if (pathParts.length - 1 === idx) {
+				if (nextPathValue !== void 0) throw new DuplicateKeyError(pathPart.pathToPart);
+				setNextPathValue(value);
+				if (isRemoved) createdByRemoved.push([
+					parent,
+					key,
+					void 0
+				]);
+			} else {
+				if (nextPathValue !== void 0 && !isJsonObject(nextPathValue) && !Array.isArray(nextPathValue)) throw new DuplicateKeyError(pathPart.pathToPart);
+				const nextPathObject = nextPathValue ?? pathPart.default;
+				currentPathObject = nextPathObject;
+				setNextPathValue(nextPathObject);
+				if (isRemoved && nextPathValue === void 0) createdByRemoved.push([
+					parent,
+					key,
+					nextPathObject
+				]);
+			}
+		});
+	}
+	for (let idx = createdByRemoved.length - 1; idx >= 0; idx--) {
+		const [parent, key, container] = createdByRemoved[idx];
+		if (container && Object.keys(container).length > 0) continue;
+		Reflect.deleteProperty(parent, key);
+		if (Array.isArray(parent)) arraysWithOrder.add(parent);
+	}
+	for (const orderedArray of Array.from(arraysWithOrder)) {
+		const values = Object.values(orderedArray);
+		orderedArray.length = 0;
+		for (const value of values) orderedArray.push(value);
+	}
+	return result;
 }
-
+exports.DepthLimitError = DepthLimitError;
 exports.DuplicateKeyError = DuplicateKeyError;
+exports.ForbiddenKeyError = ForbiddenKeyError;
+exports.InvalidPathError = InvalidPathError;
 exports.MixedArrayError = MixedArrayError;
 exports.parseFormData = parseFormData;