qs 6.2.0 → 6.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +10 -0
- package/README.md +376 -0
- package/dist/qs.js +14 -15
- package/lib/parse.js +14 -15
- package/package.json +6 -5
- package/test/parse.js +33 -5
- package/.jscs.json +0 -176
package/CHANGELOG.md
CHANGED
|
@@ -1,3 +1,10 @@
|
|
|
1
|
+
## **6.2.1**
|
|
2
|
+
- [Fix] ensure `key[]=x&key[]&key[]=y` results in 3, not 2, values
|
|
3
|
+
- [Refactor] Be explicit and use `Object.prototype.hasOwnProperty.call`
|
|
4
|
+
- [Tests] remove `parallelshell` since it does not reliably report failures
|
|
5
|
+
- [Tests] up to `node` `v6.3`, `v5.12`
|
|
6
|
+
- [Dev Deps] update `tape`, `eslint`, `@ljharb/eslint-config`, `qs-iconv`
|
|
7
|
+
|
|
1
8
|
## [**6.2.0**](https://github.com/ljharb/qs/issues?milestone=36&state=closed)
|
|
2
9
|
- [New] pass Buffers to the encoder/decoder directly (#161)
|
|
3
10
|
- [New] add "encoder" and "decoder" options, for custom param encoding/decoding (#160)
|
|
@@ -17,6 +24,9 @@
|
|
|
17
24
|
## [**6.0.0**](https://github.com/ljharb/qs/issues?milestone=31&state=closed)
|
|
18
25
|
- [**#124**](https://github.com/ljharb/qs/issues/124) Use ES6 and drop support for node < v4
|
|
19
26
|
|
|
27
|
+
## **5.2.1**
|
|
28
|
+
- [Fix] ensure `key[]=x&key[]&key[]=y` results in 3, not 2, values
|
|
29
|
+
|
|
20
30
|
## [**5.2.0**](https://github.com/ljharb/qs/issues?milestone=30&state=closed)
|
|
21
31
|
- [**#64**](https://github.com/ljharb/qs/issues/64) Add option to sort object keys in the query string
|
|
22
32
|
|
package/README.md
ADDED
|
@@ -0,0 +1,376 @@
|
|
|
1
|
+
# qs
|
|
2
|
+
|
|
3
|
+
A querystring parsing and stringifying library with some added security.
|
|
4
|
+
|
|
5
|
+
[](http://travis-ci.org/ljharb/qs)
|
|
6
|
+
|
|
7
|
+
Lead Maintainer: [Jordan Harband](https://github.com/ljharb)
|
|
8
|
+
|
|
9
|
+
The **qs** module was originally created and maintained by [TJ Holowaychuk](https://github.com/visionmedia/node-querystring).
|
|
10
|
+
|
|
11
|
+
## Usage
|
|
12
|
+
|
|
13
|
+
```javascript
|
|
14
|
+
var qs = require('qs');
|
|
15
|
+
var assert = require('assert');
|
|
16
|
+
|
|
17
|
+
var obj = qs.parse('a=c');
|
|
18
|
+
assert.deepEqual(obj, { a: 'c' });
|
|
19
|
+
|
|
20
|
+
var str = qs.stringify(obj);
|
|
21
|
+
assert.equal(str, 'a=c');
|
|
22
|
+
```
|
|
23
|
+
|
|
24
|
+
### Parsing Objects
|
|
25
|
+
|
|
26
|
+
[](#preventEval)
|
|
27
|
+
```javascript
|
|
28
|
+
qs.parse(string, [options]);
|
|
29
|
+
```
|
|
30
|
+
|
|
31
|
+
**qs** allows you to create nested objects within your query strings, by surrounding the name of sub-keys with square brackets `[]`.
|
|
32
|
+
For example, the string `'foo[bar]=baz'` converts to:
|
|
33
|
+
|
|
34
|
+
```javascript
|
|
35
|
+
assert.deepEqual(qs.parse('foo[bar]=baz'), {
|
|
36
|
+
foo: {
|
|
37
|
+
bar: 'baz'
|
|
38
|
+
}
|
|
39
|
+
});
|
|
40
|
+
```
|
|
41
|
+
|
|
42
|
+
When using the `plainObjects` option the parsed value is returned as a plain object, created via `Object.create(null)` and as such you should be aware that prototype methods will not exist on it and a user may set those names to whatever value they like:
|
|
43
|
+
|
|
44
|
+
```javascript
|
|
45
|
+
var plainObject = qs.parse('a[hasOwnProperty]=b', { plainObjects: true });
|
|
46
|
+
assert.deepEqual(plainObject, { a: { hasOwnProperty: 'b' } });
|
|
47
|
+
```
|
|
48
|
+
|
|
49
|
+
By default parameters that would overwrite properties on the object prototype are ignored, if you wish to keep the data from those fields either use `plainObjects` as mentioned above, or set `allowPrototypes` to `true` which will allow user input to overwrite those properties. *WARNING* It is generally a bad idea to enable this option as it can cause problems when attempting to use the properties that have been overwritten. Always be careful with this option.
|
|
50
|
+
|
|
51
|
+
```javascript
|
|
52
|
+
var protoObject = qs.parse('a[hasOwnProperty]=b', { allowPrototypes: true });
|
|
53
|
+
assert.deepEqual(protoObject, { a: { hasOwnProperty: 'b' } });
|
|
54
|
+
```
|
|
55
|
+
|
|
56
|
+
URI encoded strings work too:
|
|
57
|
+
|
|
58
|
+
```javascript
|
|
59
|
+
assert.deepEqual(qs.parse('a%5Bb%5D=c'), {
|
|
60
|
+
a: { b: 'c' }
|
|
61
|
+
});
|
|
62
|
+
```
|
|
63
|
+
|
|
64
|
+
You can also nest your objects, like `'foo[bar][baz]=foobarbaz'`:
|
|
65
|
+
|
|
66
|
+
```javascript
|
|
67
|
+
assert.deepEqual(qs.parse('foo[bar][baz]=foobarbaz'), {
|
|
68
|
+
foo: {
|
|
69
|
+
bar: {
|
|
70
|
+
baz: 'foobarbaz'
|
|
71
|
+
}
|
|
72
|
+
}
|
|
73
|
+
});
|
|
74
|
+
```
|
|
75
|
+
|
|
76
|
+
By default, when nesting objects **qs** will only parse up to 5 children deep. This means if you attempt to parse a string like
|
|
77
|
+
`'a[b][c][d][e][f][g][h][i]=j'` your resulting object will be:
|
|
78
|
+
|
|
79
|
+
```javascript
|
|
80
|
+
var expected = {
|
|
81
|
+
a: {
|
|
82
|
+
b: {
|
|
83
|
+
c: {
|
|
84
|
+
d: {
|
|
85
|
+
e: {
|
|
86
|
+
f: {
|
|
87
|
+
'[g][h][i]': 'j'
|
|
88
|
+
}
|
|
89
|
+
}
|
|
90
|
+
}
|
|
91
|
+
}
|
|
92
|
+
}
|
|
93
|
+
}
|
|
94
|
+
};
|
|
95
|
+
var string = 'a[b][c][d][e][f][g][h][i]=j';
|
|
96
|
+
assert.deepEqual(qs.parse(string), expected);
|
|
97
|
+
```
|
|
98
|
+
|
|
99
|
+
This depth can be overridden by passing a `depth` option to `qs.parse(string, [options])`:
|
|
100
|
+
|
|
101
|
+
```javascript
|
|
102
|
+
var deep = qs.parse('a[b][c][d][e][f][g][h][i]=j', { depth: 1 });
|
|
103
|
+
assert.deepEqual(deep, { a: { b: { '[c][d][e][f][g][h][i]': 'j' } } });
|
|
104
|
+
```
|
|
105
|
+
|
|
106
|
+
The depth limit helps mitigate abuse when **qs** is used to parse user input, and it is recommended to keep it a reasonably small number.
|
|
107
|
+
|
|
108
|
+
For similar reasons, by default **qs** will only parse up to 1000 parameters. This can be overridden by passing a `parameterLimit` option:
|
|
109
|
+
|
|
110
|
+
```javascript
|
|
111
|
+
var limited = qs.parse('a=b&c=d', { parameterLimit: 1 });
|
|
112
|
+
assert.deepEqual(limited, { a: 'b' });
|
|
113
|
+
```
|
|
114
|
+
|
|
115
|
+
An optional delimiter can also be passed:
|
|
116
|
+
|
|
117
|
+
```javascript
|
|
118
|
+
var delimited = qs.parse('a=b;c=d', { delimiter: ';' });
|
|
119
|
+
assert.deepEqual(delimited, { a: 'b', c: 'd' });
|
|
120
|
+
```
|
|
121
|
+
|
|
122
|
+
Delimiters can be a regular expression too:
|
|
123
|
+
|
|
124
|
+
```javascript
|
|
125
|
+
var regexed = qs.parse('a=b;c=d,e=f', { delimiter: /[;,]/ });
|
|
126
|
+
assert.deepEqual(regexed, { a: 'b', c: 'd', e: 'f' });
|
|
127
|
+
```
|
|
128
|
+
|
|
129
|
+
Option `allowDots` can be used to enable dot notation:
|
|
130
|
+
|
|
131
|
+
```javascript
|
|
132
|
+
var withDots = qs.parse('a.b=c', { allowDots: true });
|
|
133
|
+
assert.deepEqual(withDots, { a: { b: 'c' } });
|
|
134
|
+
```
|
|
135
|
+
|
|
136
|
+
### Parsing Arrays
|
|
137
|
+
|
|
138
|
+
**qs** can also parse arrays using a similar `[]` notation:
|
|
139
|
+
|
|
140
|
+
```javascript
|
|
141
|
+
var withArray = qs.parse('a[]=b&a[]=c');
|
|
142
|
+
assert.deepEqual(withArray, { a: ['b', 'c'] });
|
|
143
|
+
```
|
|
144
|
+
|
|
145
|
+
You may specify an index as well:
|
|
146
|
+
|
|
147
|
+
```javascript
|
|
148
|
+
var withIndexes = qs.parse('a[1]=c&a[0]=b');
|
|
149
|
+
assert.deepEqual(withIndexes, { a: ['b', 'c'] });
|
|
150
|
+
```
|
|
151
|
+
|
|
152
|
+
Note that the only difference between an index in an array and a key in an object is that the value between the brackets must be a number
|
|
153
|
+
to create an array. When creating arrays with specific indices, **qs** will compact a sparse array to only the existing values preserving
|
|
154
|
+
their order:
|
|
155
|
+
|
|
156
|
+
```javascript
|
|
157
|
+
var noSparse = qs.parse('a[1]=b&a[15]=c');
|
|
158
|
+
assert.deepEqual(noSparse, { a: ['b', 'c'] });
|
|
159
|
+
```
|
|
160
|
+
|
|
161
|
+
Note that an empty string is also a value, and will be preserved:
|
|
162
|
+
|
|
163
|
+
```javascript
|
|
164
|
+
var withEmptyString = qs.parse('a[]=&a[]=b');
|
|
165
|
+
assert.deepEqual(withEmptyString, { a: ['', 'b'] });
|
|
166
|
+
|
|
167
|
+
var withIndexedEmptyString = qs.parse('a[0]=b&a[1]=&a[2]=c');
|
|
168
|
+
assert.deepEqual(withIndexedEmptyString, { a: ['b', '', 'c'] });
|
|
169
|
+
```
|
|
170
|
+
|
|
171
|
+
**qs** will also limit specifying indices in an array to a maximum index of `20`. Any array members with an index of greater than `20` will
|
|
172
|
+
instead be converted to an object with the index as the key:
|
|
173
|
+
|
|
174
|
+
```javascript
|
|
175
|
+
var withMaxIndex = qs.parse('a[100]=b');
|
|
176
|
+
assert.deepEqual(withMaxIndex, { a: { '100': 'b' } });
|
|
177
|
+
```
|
|
178
|
+
|
|
179
|
+
This limit can be overridden by passing an `arrayLimit` option:
|
|
180
|
+
|
|
181
|
+
```javascript
|
|
182
|
+
var withArrayLimit = qs.parse('a[1]=b', { arrayLimit: 0 });
|
|
183
|
+
assert.deepEqual(withArrayLimit, { a: { '1': 'b' } });
|
|
184
|
+
```
|
|
185
|
+
|
|
186
|
+
To disable array parsing entirely, set `parseArrays` to `false`.
|
|
187
|
+
|
|
188
|
+
```javascript
|
|
189
|
+
var noParsingArrays = qs.parse('a[]=b', { parseArrays: false });
|
|
190
|
+
assert.deepEqual(noParsingArrays, { a: { '0': 'b' } });
|
|
191
|
+
```
|
|
192
|
+
|
|
193
|
+
If you mix notations, **qs** will merge the two items into an object:
|
|
194
|
+
|
|
195
|
+
```javascript
|
|
196
|
+
var mixedNotation = qs.parse('a[0]=b&a[b]=c');
|
|
197
|
+
assert.deepEqual(mixedNotation, { a: { '0': 'b', b: 'c' } });
|
|
198
|
+
```
|
|
199
|
+
|
|
200
|
+
You can also create arrays of objects:
|
|
201
|
+
|
|
202
|
+
```javascript
|
|
203
|
+
var arraysOfObjects = qs.parse('a[][b]=c');
|
|
204
|
+
assert.deepEqual(arraysOfObjects, { a: [{ b: 'c' }] });
|
|
205
|
+
```
|
|
206
|
+
|
|
207
|
+
### Stringifying
|
|
208
|
+
|
|
209
|
+
[](#preventEval)
|
|
210
|
+
```javascript
|
|
211
|
+
qs.stringify(object, [options]);
|
|
212
|
+
```
|
|
213
|
+
|
|
214
|
+
When stringifying, **qs** by default URI encodes output. Objects are stringified as you would expect:
|
|
215
|
+
|
|
216
|
+
```javascript
|
|
217
|
+
assert.equal(qs.stringify({ a: 'b' }), 'a=b');
|
|
218
|
+
assert.equal(qs.stringify({ a: { b: 'c' } }), 'a%5Bb%5D=c');
|
|
219
|
+
```
|
|
220
|
+
|
|
221
|
+
This encoding can be disabled by setting the `encode` option to `false`:
|
|
222
|
+
|
|
223
|
+
```javascript
|
|
224
|
+
var unencoded = qs.stringify({ a: { b: 'c' } }, { encode: false });
|
|
225
|
+
assert.equal(unencoded, 'a[b]=c');
|
|
226
|
+
```
|
|
227
|
+
|
|
228
|
+
This encoding can also be replaced by a custom encoding method set as `encoder` option:
|
|
229
|
+
|
|
230
|
+
```javascript
|
|
231
|
+
var encoded = qs.stringify({ a: { b: 'c' } }, { encoder: function (str) {
|
|
232
|
+
// Passed in values `a`, `b`, `c`
|
|
233
|
+
return // Return encoded string
|
|
234
|
+
}})
|
|
235
|
+
```
|
|
236
|
+
|
|
237
|
+
_(Note: the `encoder` option does not apply if `encode` is `false`)_
|
|
238
|
+
|
|
239
|
+
Analogue to the `encoder` there is a `decoder` option for `parse` to override decoding of properties and values:
|
|
240
|
+
|
|
241
|
+
```javascript
|
|
242
|
+
var decoded = qs.parse('x=z', { decoder: function (str) {
|
|
243
|
+
// Passed in values `x`, `z`
|
|
244
|
+
return // Return decoded string
|
|
245
|
+
}})
|
|
246
|
+
```
|
|
247
|
+
|
|
248
|
+
Examples beyond this point will be shown as though the output is not URI encoded for clarity. Please note that the return values in these cases *will* be URI encoded during real usage.
|
|
249
|
+
|
|
250
|
+
When arrays are stringified, by default they are given explicit indices:
|
|
251
|
+
|
|
252
|
+
```javascript
|
|
253
|
+
qs.stringify({ a: ['b', 'c', 'd'] });
|
|
254
|
+
// 'a[0]=b&a[1]=c&a[2]=d'
|
|
255
|
+
```
|
|
256
|
+
|
|
257
|
+
You may override this by setting the `indices` option to `false`:
|
|
258
|
+
|
|
259
|
+
```javascript
|
|
260
|
+
qs.stringify({ a: ['b', 'c', 'd'] }, { indices: false });
|
|
261
|
+
// 'a=b&a=c&a=d'
|
|
262
|
+
```
|
|
263
|
+
|
|
264
|
+
You may use the `arrayFormat` option to specify the format of the output array
|
|
265
|
+
|
|
266
|
+
```javascript
|
|
267
|
+
qs.stringify({ a: ['b', 'c'] }, { arrayFormat: 'indices' })
|
|
268
|
+
// 'a[0]=b&a[1]=c'
|
|
269
|
+
qs.stringify({ a: ['b', 'c'] }, { arrayFormat: 'brackets' })
|
|
270
|
+
// 'a[]=b&a[]=c'
|
|
271
|
+
qs.stringify({ a: ['b', 'c'] }, { arrayFormat: 'repeat' })
|
|
272
|
+
// 'a=b&a=c'
|
|
273
|
+
```
|
|
274
|
+
|
|
275
|
+
Empty strings and null values will omit the value, but the equals sign (=) remains in place:
|
|
276
|
+
|
|
277
|
+
```javascript
|
|
278
|
+
assert.equal(qs.stringify({ a: '' }), 'a=');
|
|
279
|
+
```
|
|
280
|
+
|
|
281
|
+
Properties that are set to `undefined` will be omitted entirely:
|
|
282
|
+
|
|
283
|
+
```javascript
|
|
284
|
+
assert.equal(qs.stringify({ a: null, b: undefined }), 'a=');
|
|
285
|
+
```
|
|
286
|
+
|
|
287
|
+
The delimiter may be overridden with stringify as well:
|
|
288
|
+
|
|
289
|
+
```javascript
|
|
290
|
+
assert.equal(qs.stringify({ a: 'b', c: 'd' }, { delimiter: ';' }), 'a=b;c=d');
|
|
291
|
+
```
|
|
292
|
+
|
|
293
|
+
Finally, you can use the `filter` option to restrict which keys will be included in the stringified output.
|
|
294
|
+
If you pass a function, it will be called for each key to obtain the replacement value. Otherwise, if you
|
|
295
|
+
pass an array, it will be used to select properties and array indices for stringification:
|
|
296
|
+
|
|
297
|
+
```javascript
|
|
298
|
+
function filterFunc(prefix, value) {
|
|
299
|
+
if (prefix == 'b') {
|
|
300
|
+
// Return an `undefined` value to omit a property.
|
|
301
|
+
return;
|
|
302
|
+
}
|
|
303
|
+
if (prefix == 'e[f]') {
|
|
304
|
+
return value.getTime();
|
|
305
|
+
}
|
|
306
|
+
if (prefix == 'e[g][0]') {
|
|
307
|
+
return value * 2;
|
|
308
|
+
}
|
|
309
|
+
return value;
|
|
310
|
+
}
|
|
311
|
+
qs.stringify({ a: 'b', c: 'd', e: { f: new Date(123), g: [2] } }, { filter: filterFunc });
|
|
312
|
+
// 'a=b&c=d&e[f]=123&e[g][0]=4'
|
|
313
|
+
qs.stringify({ a: 'b', c: 'd', e: 'f' }, { filter: ['a', 'e'] });
|
|
314
|
+
// 'a=b&e=f'
|
|
315
|
+
qs.stringify({ a: ['b', 'c', 'd'], e: 'f' }, { filter: ['a', 0, 2] });
|
|
316
|
+
// 'a[0]=b&a[2]=d'
|
|
317
|
+
```
|
|
318
|
+
|
|
319
|
+
### Handling of `null` values
|
|
320
|
+
|
|
321
|
+
By default, `null` values are treated like empty strings:
|
|
322
|
+
|
|
323
|
+
```javascript
|
|
324
|
+
var withNull = qs.stringify({ a: null, b: '' });
|
|
325
|
+
assert.equal(withNull, 'a=&b=');
|
|
326
|
+
```
|
|
327
|
+
|
|
328
|
+
Parsing does not distinguish between parameters with and without equal signs. Both are converted to empty strings.
|
|
329
|
+
|
|
330
|
+
```javascript
|
|
331
|
+
var equalsInsensitive = qs.parse('a&b=');
|
|
332
|
+
assert.deepEqual(equalsInsensitive, { a: '', b: '' });
|
|
333
|
+
```
|
|
334
|
+
|
|
335
|
+
To distinguish between `null` values and empty strings use the `strictNullHandling` flag. In the result string the `null`
|
|
336
|
+
values have no `=` sign:
|
|
337
|
+
|
|
338
|
+
```javascript
|
|
339
|
+
var strictNull = qs.stringify({ a: null, b: '' }, { strictNullHandling: true });
|
|
340
|
+
assert.equal(strictNull, 'a&b=');
|
|
341
|
+
```
|
|
342
|
+
|
|
343
|
+
To parse values without `=` back to `null` use the `strictNullHandling` flag:
|
|
344
|
+
|
|
345
|
+
```javascript
|
|
346
|
+
var parsedStrictNull = qs.parse('a&b=', { strictNullHandling: true });
|
|
347
|
+
assert.deepEqual(parsedStrictNull, { a: null, b: '' });
|
|
348
|
+
```
|
|
349
|
+
|
|
350
|
+
To completely skip rendering keys with `null` values, use the `skipNulls` flag:
|
|
351
|
+
|
|
352
|
+
```javascript
|
|
353
|
+
var nullsSkipped = qs.stringify({ a: 'b', c: null}, { skipNulls: true });
|
|
354
|
+
assert.equal(nullsSkipped, 'a=b');
|
|
355
|
+
```
|
|
356
|
+
|
|
357
|
+
### Dealing with special character sets
|
|
358
|
+
|
|
359
|
+
By default the encoding and decoding of characters is done in `utf-8`. If you
|
|
360
|
+
wish to encode querystrings to a different character set (i.e.
|
|
361
|
+
[Shift JIS](https://en.wikipedia.org/wiki/Shift_JIS)) you can use the
|
|
362
|
+
[`qs-iconv`](https://github.com/martinheidegger/qs-iconv) library:
|
|
363
|
+
|
|
364
|
+
```javascript
|
|
365
|
+
var encoder = require('qs-iconv/encoder')('shift_jis');
|
|
366
|
+
var shiftJISEncoded = qs.stringify({ a: 'こんにちは!' }, { encoder: encoder });
|
|
367
|
+
assert.equal(shiftJISEncoded, 'a=%82%B1%82%F1%82%C9%82%BF%82%CD%81I');
|
|
368
|
+
```
|
|
369
|
+
|
|
370
|
+
This also works for decoding of query strings:
|
|
371
|
+
|
|
372
|
+
```javascript
|
|
373
|
+
var decoder = require('qs-iconv/decoder')('shift_jis');
|
|
374
|
+
var obj = qs.parse('a=%82%B1%82%F1%82%C9%82%BF%82%CD%81I', { decoder: decoder });
|
|
375
|
+
assert.deepEqual(obj, { a: 'こんにちは!' });
|
|
376
|
+
```
|
package/dist/qs.js
CHANGED
|
@@ -14,6 +14,8 @@ module.exports = {
|
|
|
14
14
|
|
|
15
15
|
var Utils = require('./utils');
|
|
16
16
|
|
|
17
|
+
var has = Object.prototype.hasOwnProperty;
|
|
18
|
+
|
|
17
19
|
var defaults = {
|
|
18
20
|
delimiter: '&',
|
|
19
21
|
depth: 5,
|
|
@@ -34,21 +36,18 @@ var parseValues = function parseValues(str, options) {
|
|
|
34
36
|
var part = parts[i];
|
|
35
37
|
var pos = part.indexOf(']=') === -1 ? part.indexOf('=') : part.indexOf(']=') + 1;
|
|
36
38
|
|
|
39
|
+
var key, val;
|
|
37
40
|
if (pos === -1) {
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
if (options.strictNullHandling) {
|
|
41
|
-
obj[options.decoder(part)] = null;
|
|
42
|
-
}
|
|
41
|
+
key = options.decoder(part);
|
|
42
|
+
val = options.strictNullHandling ? null : '';
|
|
43
43
|
} else {
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
}
|
|
44
|
+
key = options.decoder(part.slice(0, pos));
|
|
45
|
+
val = options.decoder(part.slice(pos + 1));
|
|
46
|
+
}
|
|
47
|
+
if (has.call(obj, key)) {
|
|
48
|
+
obj[key] = [].concat(obj[key]).concat(val);
|
|
49
|
+
} else {
|
|
50
|
+
obj[key] = val;
|
|
52
51
|
}
|
|
53
52
|
}
|
|
54
53
|
|
|
@@ -110,7 +109,7 @@ var parseKeys = function parseKeys(givenKey, val, options) {
|
|
|
110
109
|
if (segment[1]) {
|
|
111
110
|
// If we aren't using plain objects, optionally prefix keys
|
|
112
111
|
// that would overwrite object prototype properties
|
|
113
|
-
if (!options.plainObjects && Object.prototype
|
|
112
|
+
if (!options.plainObjects && has.call(Object.prototype, segment[1])) {
|
|
114
113
|
if (!options.allowPrototypes) {
|
|
115
114
|
return;
|
|
116
115
|
}
|
|
@@ -124,7 +123,7 @@ var parseKeys = function parseKeys(givenKey, val, options) {
|
|
|
124
123
|
var i = 0;
|
|
125
124
|
while ((segment = child.exec(key)) !== null && i < options.depth) {
|
|
126
125
|
i += 1;
|
|
127
|
-
if (!options.plainObjects && Object.prototype
|
|
126
|
+
if (!options.plainObjects && has.call(Object.prototype, segment[1].replace(/\[|\]/g, ''))) {
|
|
128
127
|
if (!options.allowPrototypes) {
|
|
129
128
|
continue;
|
|
130
129
|
}
|
package/lib/parse.js
CHANGED
|
@@ -2,6 +2,8 @@
|
|
|
2
2
|
|
|
3
3
|
var Utils = require('./utils');
|
|
4
4
|
|
|
5
|
+
var has = Object.prototype.hasOwnProperty;
|
|
6
|
+
|
|
5
7
|
var defaults = {
|
|
6
8
|
delimiter: '&',
|
|
7
9
|
depth: 5,
|
|
@@ -22,21 +24,18 @@ var parseValues = function parseValues(str, options) {
|
|
|
22
24
|
var part = parts[i];
|
|
23
25
|
var pos = part.indexOf(']=') === -1 ? part.indexOf('=') : part.indexOf(']=') + 1;
|
|
24
26
|
|
|
27
|
+
var key, val;
|
|
25
28
|
if (pos === -1) {
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
if (options.strictNullHandling) {
|
|
29
|
-
obj[options.decoder(part)] = null;
|
|
30
|
-
}
|
|
29
|
+
key = options.decoder(part);
|
|
30
|
+
val = options.strictNullHandling ? null : '';
|
|
31
31
|
} else {
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
}
|
|
32
|
+
key = options.decoder(part.slice(0, pos));
|
|
33
|
+
val = options.decoder(part.slice(pos + 1));
|
|
34
|
+
}
|
|
35
|
+
if (has.call(obj, key)) {
|
|
36
|
+
obj[key] = [].concat(obj[key]).concat(val);
|
|
37
|
+
} else {
|
|
38
|
+
obj[key] = val;
|
|
40
39
|
}
|
|
41
40
|
}
|
|
42
41
|
|
|
@@ -98,7 +97,7 @@ var parseKeys = function parseKeys(givenKey, val, options) {
|
|
|
98
97
|
if (segment[1]) {
|
|
99
98
|
// If we aren't using plain objects, optionally prefix keys
|
|
100
99
|
// that would overwrite object prototype properties
|
|
101
|
-
if (!options.plainObjects && Object.prototype
|
|
100
|
+
if (!options.plainObjects && has.call(Object.prototype, segment[1])) {
|
|
102
101
|
if (!options.allowPrototypes) {
|
|
103
102
|
return;
|
|
104
103
|
}
|
|
@@ -112,7 +111,7 @@ var parseKeys = function parseKeys(givenKey, val, options) {
|
|
|
112
111
|
var i = 0;
|
|
113
112
|
while ((segment = child.exec(key)) !== null && i < options.depth) {
|
|
114
113
|
i += 1;
|
|
115
|
-
if (!options.plainObjects && Object.prototype
|
|
114
|
+
if (!options.plainObjects && has.call(Object.prototype, segment[1].replace(/\[|\]/g, ''))) {
|
|
116
115
|
if (!options.allowPrototypes) {
|
|
117
116
|
continue;
|
|
118
117
|
}
|
package/package.json
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
"name": "qs",
|
|
3
3
|
"description": "A querystring parser that supports nesting and arrays, with a depth limit",
|
|
4
4
|
"homepage": "https://github.com/ljharb/qs",
|
|
5
|
-
"version": "6.2.
|
|
5
|
+
"version": "6.2.1",
|
|
6
6
|
"repository": {
|
|
7
7
|
"type": "git",
|
|
8
8
|
"url": "https://github.com/ljharb/qs.git"
|
|
@@ -25,17 +25,18 @@
|
|
|
25
25
|
"dependencies": {},
|
|
26
26
|
"devDependencies": {
|
|
27
27
|
"browserify": "^13.0.1",
|
|
28
|
-
"tape": "^4.
|
|
28
|
+
"tape": "^4.6.0",
|
|
29
29
|
"covert": "^1.1.0",
|
|
30
30
|
"mkdirp": "^0.5.1",
|
|
31
|
-
"eslint": "^
|
|
32
|
-
"@ljharb/eslint-config": "^
|
|
31
|
+
"eslint": "^3.1.0",
|
|
32
|
+
"@ljharb/eslint-config": "^6.0.0",
|
|
33
33
|
"parallelshell": "^2.0.0",
|
|
34
34
|
"iconv-lite": "^0.4.13",
|
|
35
|
+
"qs-iconv": "^1.0.3",
|
|
35
36
|
"evalmd": "^0.0.17"
|
|
36
37
|
},
|
|
37
38
|
"scripts": {
|
|
38
|
-
"pretest": "
|
|
39
|
+
"pretest": "npm run --silent readme && npm run --silent lint",
|
|
39
40
|
"test": "npm run --silent coverage",
|
|
40
41
|
"tests-only": "node test",
|
|
41
42
|
"readme": "evalmd README.md",
|
package/test/parse.js
CHANGED
|
@@ -121,8 +121,11 @@ test('parse()', function (t) {
|
|
|
121
121
|
st.deepEqual(qs.parse('foo[]=bar&foo[bad]=baz'), { foo: { '0': 'bar', bad: 'baz' } });
|
|
122
122
|
st.deepEqual(qs.parse('foo[bad]=baz&foo[]=bar&foo[]=foo'), { foo: { bad: 'baz', '0': 'bar', '1': 'foo' } });
|
|
123
123
|
st.deepEqual(qs.parse('foo[0][a]=a&foo[0][b]=b&foo[1][a]=aa&foo[1][b]=bb'), { foo: [{ a: 'a', b: 'b' }, { a: 'aa', b: 'bb' }] });
|
|
124
|
-
|
|
125
|
-
st.deepEqual(qs.parse('a[]=b&a[
|
|
124
|
+
|
|
125
|
+
st.deepEqual(qs.parse('a[]=b&a[t]=u&a[hasOwnProperty]=c', { allowPrototypes: false }), { a: { '0': 'b', c: true, t: 'u' } });
|
|
126
|
+
st.deepEqual(qs.parse('a[]=b&a[t]=u&a[hasOwnProperty]=c', { allowPrototypes: true }), { a: { '0': 'b', t: 'u', hasOwnProperty: 'c' } });
|
|
127
|
+
st.deepEqual(qs.parse('a[]=b&a[hasOwnProperty]=c&a[x]=y', { allowPrototypes: false }), { a: { '0': 'b', '1': 'c', x: 'y' } });
|
|
128
|
+
st.deepEqual(qs.parse('a[]=b&a[hasOwnProperty]=c&a[x]=y', { allowPrototypes: true }), { a: { '0': 'b', hasOwnProperty: 'c', x: 'y' } });
|
|
126
129
|
st.end();
|
|
127
130
|
});
|
|
128
131
|
|
|
@@ -174,9 +177,34 @@ test('parse()', function (t) {
|
|
|
174
177
|
|
|
175
178
|
t.test('allows for empty strings in arrays', function (st) {
|
|
176
179
|
st.deepEqual(qs.parse('a[]=b&a[]=&a[]=c'), { a: ['b', '', 'c'] });
|
|
177
|
-
|
|
178
|
-
st.deepEqual(
|
|
179
|
-
|
|
180
|
+
|
|
181
|
+
st.deepEqual(
|
|
182
|
+
qs.parse('a[0]=b&a[1]&a[2]=c&a[19]=', { strictNullHandling: true, arrayLimit: 20 }),
|
|
183
|
+
{ a: ['b', null, 'c', ''] },
|
|
184
|
+
'with arrayLimit 20 + array indices: null then empty string works'
|
|
185
|
+
);
|
|
186
|
+
st.deepEqual(
|
|
187
|
+
qs.parse('a[]=b&a[]&a[]=c&a[]=', { strictNullHandling: true, arrayLimit: 0 }),
|
|
188
|
+
{ a: ['b', null, 'c', ''] },
|
|
189
|
+
'with arrayLimit 0 + array brackets: null then empty string works'
|
|
190
|
+
);
|
|
191
|
+
|
|
192
|
+
st.deepEqual(
|
|
193
|
+
qs.parse('a[0]=b&a[1]=&a[2]=c&a[19]', { strictNullHandling: true, arrayLimit: 20 }),
|
|
194
|
+
{ a: ['b', '', 'c', null] },
|
|
195
|
+
'with arrayLimit 20 + array indices: empty string then null works'
|
|
196
|
+
);
|
|
197
|
+
st.deepEqual(
|
|
198
|
+
qs.parse('a[]=b&a[]=&a[]=c&a[]', { strictNullHandling: true, arrayLimit: 0 }),
|
|
199
|
+
{ a: ['b', '', 'c', null] },
|
|
200
|
+
'with arrayLimit 0 + array brackets: empty string then null works'
|
|
201
|
+
);
|
|
202
|
+
|
|
203
|
+
st.deepEqual(
|
|
204
|
+
qs.parse('a[]=&a[]=b&a[]=c'),
|
|
205
|
+
{ a: ['', 'b', 'c'] },
|
|
206
|
+
'array brackets: empty strings work'
|
|
207
|
+
);
|
|
180
208
|
st.end();
|
|
181
209
|
});
|
|
182
210
|
|
package/.jscs.json
DELETED
|
@@ -1,176 +0,0 @@
|
|
|
1
|
-
{
|
|
2
|
-
"es3": true,
|
|
3
|
-
|
|
4
|
-
"additionalRules": [],
|
|
5
|
-
|
|
6
|
-
"requireSemicolons": true,
|
|
7
|
-
|
|
8
|
-
"disallowMultipleSpaces": true,
|
|
9
|
-
|
|
10
|
-
"disallowIdentifierNames": [],
|
|
11
|
-
|
|
12
|
-
"requireCurlyBraces": {
|
|
13
|
-
"allExcept": [],
|
|
14
|
-
"keywords": ["if", "else", "for", "while", "do", "try", "catch"]
|
|
15
|
-
},
|
|
16
|
-
|
|
17
|
-
"requireSpaceAfterKeywords": ["if", "else", "for", "while", "do", "switch", "return", "try", "catch", "function"],
|
|
18
|
-
|
|
19
|
-
"disallowSpaceAfterKeywords": [],
|
|
20
|
-
|
|
21
|
-
"disallowSpaceBeforeComma": true,
|
|
22
|
-
"disallowSpaceAfterComma": false,
|
|
23
|
-
"disallowSpaceBeforeSemicolon": true,
|
|
24
|
-
|
|
25
|
-
"disallowNodeTypes": [
|
|
26
|
-
"DebuggerStatement",
|
|
27
|
-
"ForInStatement",
|
|
28
|
-
"LabeledStatement",
|
|
29
|
-
"SwitchCase",
|
|
30
|
-
"SwitchStatement",
|
|
31
|
-
"WithStatement"
|
|
32
|
-
],
|
|
33
|
-
|
|
34
|
-
"requireObjectKeysOnNewLine": { "allExcept": ["sameLine"] },
|
|
35
|
-
|
|
36
|
-
"requireSpacesInAnonymousFunctionExpression": { "beforeOpeningRoundBrace": true, "beforeOpeningCurlyBrace": true },
|
|
37
|
-
"requireSpacesInNamedFunctionExpression": { "beforeOpeningCurlyBrace": true },
|
|
38
|
-
"disallowSpacesInNamedFunctionExpression": { "beforeOpeningRoundBrace": true },
|
|
39
|
-
"requireSpacesInFunctionDeclaration": { "beforeOpeningCurlyBrace": true },
|
|
40
|
-
"disallowSpacesInFunctionDeclaration": { "beforeOpeningRoundBrace": true },
|
|
41
|
-
|
|
42
|
-
"requireSpaceBetweenArguments": true,
|
|
43
|
-
|
|
44
|
-
"disallowSpacesInsideParentheses": true,
|
|
45
|
-
|
|
46
|
-
"disallowSpacesInsideArrayBrackets": true,
|
|
47
|
-
|
|
48
|
-
"disallowQuotedKeysInObjects": { "allExcept": ["reserved"] },
|
|
49
|
-
|
|
50
|
-
"disallowSpaceAfterObjectKeys": true,
|
|
51
|
-
|
|
52
|
-
"requireCommaBeforeLineBreak": true,
|
|
53
|
-
|
|
54
|
-
"disallowSpaceAfterPrefixUnaryOperators": ["++", "--", "+", "-", "~", "!"],
|
|
55
|
-
"requireSpaceAfterPrefixUnaryOperators": [],
|
|
56
|
-
|
|
57
|
-
"disallowSpaceBeforePostfixUnaryOperators": ["++", "--"],
|
|
58
|
-
"requireSpaceBeforePostfixUnaryOperators": [],
|
|
59
|
-
|
|
60
|
-
"disallowSpaceBeforeBinaryOperators": [],
|
|
61
|
-
"requireSpaceBeforeBinaryOperators": ["+", "-", "/", "*", "=", "==", "===", "!=", "!=="],
|
|
62
|
-
|
|
63
|
-
"requireSpaceAfterBinaryOperators": ["+", "-", "/", "*", "=", "==", "===", "!=", "!=="],
|
|
64
|
-
"disallowSpaceAfterBinaryOperators": [],
|
|
65
|
-
|
|
66
|
-
"disallowImplicitTypeConversion": ["binary", "string"],
|
|
67
|
-
|
|
68
|
-
"disallowKeywords": ["with", "eval"],
|
|
69
|
-
|
|
70
|
-
"requireKeywordsOnNewLine": [],
|
|
71
|
-
"disallowKeywordsOnNewLine": ["else"],
|
|
72
|
-
|
|
73
|
-
"requireLineFeedAtFileEnd": true,
|
|
74
|
-
|
|
75
|
-
"disallowTrailingWhitespace": true,
|
|
76
|
-
|
|
77
|
-
"disallowTrailingComma": true,
|
|
78
|
-
|
|
79
|
-
"excludeFiles": ["node_modules/**", "vendor/**"],
|
|
80
|
-
|
|
81
|
-
"disallowMultipleLineStrings": true,
|
|
82
|
-
|
|
83
|
-
"requireDotNotation": { "allExcept": ["keywords"] },
|
|
84
|
-
|
|
85
|
-
"requireParenthesesAroundIIFE": true,
|
|
86
|
-
|
|
87
|
-
"validateLineBreaks": "LF",
|
|
88
|
-
|
|
89
|
-
"validateQuoteMarks": {
|
|
90
|
-
"escape": true,
|
|
91
|
-
"mark": "'"
|
|
92
|
-
},
|
|
93
|
-
|
|
94
|
-
"disallowOperatorBeforeLineBreak": [],
|
|
95
|
-
|
|
96
|
-
"requireSpaceBeforeKeywords": [
|
|
97
|
-
"do",
|
|
98
|
-
"for",
|
|
99
|
-
"if",
|
|
100
|
-
"else",
|
|
101
|
-
"switch",
|
|
102
|
-
"case",
|
|
103
|
-
"try",
|
|
104
|
-
"catch",
|
|
105
|
-
"finally",
|
|
106
|
-
"while",
|
|
107
|
-
"with",
|
|
108
|
-
"return"
|
|
109
|
-
],
|
|
110
|
-
|
|
111
|
-
"validateAlignedFunctionParameters": {
|
|
112
|
-
"lineBreakAfterOpeningBraces": true,
|
|
113
|
-
"lineBreakBeforeClosingBraces": true
|
|
114
|
-
},
|
|
115
|
-
|
|
116
|
-
"requirePaddingNewLinesBeforeExport": true,
|
|
117
|
-
|
|
118
|
-
"validateNewlineAfterArrayElements": {
|
|
119
|
-
"maximum": 1
|
|
120
|
-
},
|
|
121
|
-
|
|
122
|
-
"requirePaddingNewLinesAfterUseStrict": true,
|
|
123
|
-
|
|
124
|
-
"disallowArrowFunctions": true,
|
|
125
|
-
|
|
126
|
-
"disallowMultiLineTernary": true,
|
|
127
|
-
|
|
128
|
-
"validateOrderInObjectKeys": "asc-insensitive",
|
|
129
|
-
|
|
130
|
-
"disallowIdenticalDestructuringNames": true,
|
|
131
|
-
|
|
132
|
-
"disallowNestedTernaries": { "maxLevel": 1 },
|
|
133
|
-
|
|
134
|
-
"requireSpaceAfterComma": { "allExcept": ["trailing"] },
|
|
135
|
-
"requireAlignedMultilineParams": false,
|
|
136
|
-
|
|
137
|
-
"requireSpacesInGenerator": {
|
|
138
|
-
"afterStar": true
|
|
139
|
-
},
|
|
140
|
-
|
|
141
|
-
"disallowSpacesInGenerator": {
|
|
142
|
-
"beforeStar": true
|
|
143
|
-
},
|
|
144
|
-
|
|
145
|
-
"disallowVar": false,
|
|
146
|
-
|
|
147
|
-
"requireArrayDestructuring": false,
|
|
148
|
-
|
|
149
|
-
"requireEnhancedObjectLiterals": false,
|
|
150
|
-
|
|
151
|
-
"requireObjectDestructuring": false,
|
|
152
|
-
|
|
153
|
-
"requireEarlyReturn": false,
|
|
154
|
-
|
|
155
|
-
"requireCapitalizedConstructorsNew": {
|
|
156
|
-
"allExcept": ["Function", "String", "Object", "Symbol", "Number", "Date", "RegExp", "Error", "Boolean", "Array"]
|
|
157
|
-
},
|
|
158
|
-
|
|
159
|
-
"requireImportAlphabetized": false,
|
|
160
|
-
|
|
161
|
-
"requireSpaceBeforeObjectValues": true,
|
|
162
|
-
"requireSpaceBeforeDestructuredValues": true,
|
|
163
|
-
|
|
164
|
-
"disallowSpacesInsideTemplateStringPlaceholders": true,
|
|
165
|
-
|
|
166
|
-
"disallowArrayDestructuringReturn": false,
|
|
167
|
-
|
|
168
|
-
"requireNewlineBeforeSingleStatementsInIf": false,
|
|
169
|
-
|
|
170
|
-
"disallowUnusedVariables": true,
|
|
171
|
-
|
|
172
|
-
"requireSpacesInsideImportedObjectBraces": true,
|
|
173
|
-
|
|
174
|
-
"requireUseStrict": true
|
|
175
|
-
}
|
|
176
|
-
|