qs 6.6.1 → 6.7.0

package/.editorconfig

@@ -8,14 +8,10 @@ charset = utf-8
 trim_trailing_whitespace = true
 insert_final_newline = true
 max_line_length = 160
-quote_type = single
 
 [test/*]
 max_line_length = off
 
-[LICENSE.md]
-indent_size = off
-
 [*.md]
 max_line_length = off
 
@@ -32,12 +28,3 @@ indent_size = 2
 [LICENSE]
 indent_size = 2
 max_line_length = off
-
-[coverage/**/*]
-indent_size = off
-indent_style = off
-indent = off
-max_line_length = off
-
-[.nycrc]
-indent_style = tab

package/.eslintignore

@@ -0,0 +1 @@
+dist

package/.eslintrc

@@ -3,14 +3,10 @@
 
     "extends": "@ljharb",
 
-    "ignorePatterns": [
-        "dist/",
-    ],
-
     "rules": {
         "complexity": 0,
         "consistent-return": 1,
-        "func-name-matching": 0,
+		"func-name-matching": 0,
         "id-length": [2, { "min": 1, "max": 25, "properties": "never" }],
         "indent": [2, 4],
         "max-lines-per-function": [2, { "max": 150 }],
@@ -19,20 +15,7 @@
         "multiline-comment-style": 0,
         "no-continue": 1,
         "no-magic-numbers": 0,
-        "no-param-reassign": 1,
         "no-restricted-syntax": [2, "BreakStatement", "DebuggerStatement", "ForInStatement", "LabeledStatement", "WithStatement"],
         "operator-linebreak": [2, "before"],
-    },
-
-    "overrides": [
-        {
-            "files": "test/**",
-            "rules": {
-                "max-lines-per-function": 0,
-                "max-statements": 0,
-                "no-extend-native": 0,
-                "function-paren-newline": 0,
-            },
-        },
-    ],
+    }
 }

package/CHANGELOG.md

@@ -1,28 +1,16 @@
-## **6.6.1**
-- [Fix] `parse`: ignore `__proto__` keys (#428)
-- [Fix] fix for an impossible situation: when the formatter is called with a non-string value
-- [Fix] `utils.merge`: avoid a crash with a null target and an array source
-- [Fix] `utils.merge`: avoid a crash with a null target and a truthy non-array source
-- [Fix] correctly parse nested arrays
-- [Robustness] `stringify`: avoid relying on a global `undefined` (#427)
+## **6.7.0**
+- [New] `stringify`/`parse`: add `comma` as an `arrayFormat` option (#276, #219)
+- [Fix] correctly parse nested arrays (#212)
+- [Fix] `utils.merge`: avoid a crash with a null target and a truthy non-array source, also with an array source
 - [Robustness] `stringify`: cache `Object.prototype.hasOwnProperty`
-- [Refactor] `formats`: tiny bit of cleanup.
 - [Refactor] `utils`: `isBuffer`: small tweak; add tests
-- [Refactor]: `stringify`/`utils`: cache `Array.isArray`
-- [Refactor] `utils`: reduce observable [[Get]]s
 - [Refactor] use cached `Array.isArray`
 - [Refactor] `parse`/`stringify`: make a function to normalize the options
-- [readme] remove travis badge; add github actions/codecov badges; update URLs
-- [Docs] Clarify the need for "arrayLimit" option
-- [meta] fix README.md (#399)
-- [meta] do not publish workflow files
-- [meta] Clean up license text so it’s properly detected as BSD-3-Clause
-- [meta] add FUNDING.yml
-- [meta] Fixes typo in CHANGELOG.md
-- [actions] backport actions from main
-- [Tests] fix Buffer tests to work in node < 4.5 and node < 5.10
+- [Refactor] `utils`: reduce observable [[Get]]s
+- [Refactor] `stringify`/`utils`: cache `Array.isArray`
 - [Tests] always use `String(x)` over `x.toString()`
-- [Dev Deps] backport from main
+- [Tests] fix Buffer tests to work in node < 4.5 and node < 5.10
+- [Tests] temporarily allow coverage to fail
 
 ## **6.6.0**
 - [New] Add support for iso-8859-1, utf8 "sentinel" and numeric entities (#268)

package/LICENSE

@@ -0,0 +1,28 @@
+Copyright (c) 2014 Nathan LaFreniere and other contributors.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    * The names of any contributors may not be used to endorse or promote
+      products derived from this software without specific prior written
+      permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS AND CONTRIBUTORS BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+                                  *   *   *
+
+The complete list of contributors can be found at: https://github.com/hapijs/qs/graphs/contributors

package/README.md

@@ -1,13 +1,12 @@
 # qs <sup>[![Version Badge][2]][1]</sup>
 
-[![github actions][actions-image]][actions-url]
-[![coverage][codecov-image]][codecov-url]
-[![dependency status][deps-svg]][deps-url]
-[![dev dependency status][dev-deps-svg]][dev-deps-url]
+[![Build Status][3]][4]
+[![dependency status][5]][6]
+[![dev dependency status][7]][8]
 [![License][license-image]][license-url]
 [![Downloads][downloads-image]][downloads-url]
 
-[![npm badge][npm-badge-png]][package-url]
+[![npm badge][11]][1]
 
 A querystring parsing and stringifying library with some added security.
 
@@ -274,6 +273,13 @@ var arraysOfObjects = qs.parse('a[][b]=c');
 assert.deepEqual(arraysOfObjects, { a: [{ b: 'c' }] });
 ```
 
+Some people use comma to join array, **qs** can parse it:
+```javascript
+var arraysOfObjects = qs.parse('a=b,c', { comma: true })
+assert.deepEqual(arraysOfObjects, { a: ['b', 'c'] })
+```
+(_this cannot convert nested objects, such as `a={b:1},{c:d}`_)
+
 ### Stringifying
 
 [](#preventEval)
@@ -324,30 +330,6 @@ var decoded = qs.parse('x=z', { decoder: function (str) {
 }})
 ```
 
-You can encode keys and values using different logic by using the type argument provided to the encoder:
-
-```javascript
-var encoded = qs.stringify({ a: { b: 'c' } }, { encoder: function (str, defaultEncoder, charset, type) {
-    if (type === 'key') {
-        return // Encoded key
-    } else if (type === 'value') {
-        return // Encoded value
-    }
-}})
-```
-
-The type argument is also provided to the decoder:
-
-```javascript
-var decoded = qs.parse('x=z', { decoder: function (str, defaultDecoder, charset, type) {
-    if (type === 'key') {
-        return // Decoded key
-    } else if (type === 'value') {
-        return // Decoded value
-    }
-}})
-```
-
 Examples beyond this point will be shown as though the output is not URI encoded for clarity. Please note that the return values in these cases *will* be URI encoded during real usage.
 
 When arrays are stringified, by default they are given explicit indices:
@@ -373,6 +355,8 @@ qs.stringify({ a: ['b', 'c'] }, { arrayFormat: 'brackets' })
 // 'a[]=b&a[]=c'
 qs.stringify({ a: ['b', 'c'] }, { arrayFormat: 'repeat' })
 // 'a=b&a=c'
+qs.stringify({ a: ['b', 'c'] }, { arrayFormat: 'comma' })
+// 'a=b,c'
 ```
 
 When objects are stringified, by default they use bracket notation:
@@ -569,28 +553,18 @@ assert.equal(qs.stringify({ a: 'b c' }, { format : 'RFC3986' }), 'a=b%20c');
 assert.equal(qs.stringify({ a: 'b c' }, { format : 'RFC1738' }), 'a=b+c');
 ```
 
-## Security
-
-Please email [@ljharb](https://github.com/ljharb) or see https://tidelift.com/security if you have a potential security vulnerability to report.
-
-## qs for enterprise
-
-Available as part of the Tidelift Subscription
-
-The maintainers of qs and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source dependencies you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact dependencies you use. [Learn more.](https://tidelift.com/subscription/pkg/npm-qs?utm_source=npm-qs&utm_medium=referral&utm_campaign=enterprise&utm_term=repo)
-
-[package-url]: https://npmjs.org/package/qs
-[npm-version-svg]: https://versionbadg.es/ljharb/qs.svg
-[deps-svg]: https://david-dm.org/ljharb/qs.svg
-[deps-url]: https://david-dm.org/ljharb/qs
-[dev-deps-svg]: https://david-dm.org/ljharb/qs/dev-status.svg
-[dev-deps-url]: https://david-dm.org/ljharb/qs#info=devDependencies
-[npm-badge-png]: https://nodei.co/npm/qs.png?downloads=true&stars=true
-[license-image]: https://img.shields.io/npm/l/qs.svg
+[1]: https://npmjs.org/package/qs
+[2]: http://versionbadg.es/ljharb/qs.svg
+[3]: https://api.travis-ci.org/ljharb/qs.svg
+[4]: https://travis-ci.org/ljharb/qs
+[5]: https://david-dm.org/ljharb/qs.svg
+[6]: https://david-dm.org/ljharb/qs
+[7]: https://david-dm.org/ljharb/qs/dev-status.svg
+[8]: https://david-dm.org/ljharb/qs?type=dev
+[9]: https://ci.testling.com/ljharb/qs.png
+[10]: https://ci.testling.com/ljharb/qs
+[11]: https://nodei.co/npm/qs.png?downloads=true&stars=true
+[license-image]: http://img.shields.io/npm/l/qs.svg
 [license-url]: LICENSE
-[downloads-image]: https://img.shields.io/npm/dm/qs.svg
-[downloads-url]: https://npm-stat.com/charts.html?package=qs
-[codecov-image]: https://codecov.io/gh/ljharb/qs/branch/main/graphs/badge.svg
-[codecov-url]: https://app.codecov.io/gh/ljharb/qs/
-[actions-image]: https://img.shields.io/endpoint?url=https://github-actions-badge-u3jn4tfpocch.runkit.sh/ljharb/qs
-[actions-url]: https://github.com/ljharb/qs/actions
+[downloads-image]: http://img.shields.io/npm/dm/qs.svg
+[downloads-url]: http://npm-stat.com/charts.html?package=qs

package/dist/qs.js

@@ -4,29 +4,21 @@
 var replace = String.prototype.replace;
 var percentTwenties = /%20/g;
 
-var util = require('./utils');
-
-var Format = {
+module.exports = {
+    'default': 'RFC3986',
+    formatters: {
+        RFC1738: function (value) {
+            return replace.call(value, percentTwenties, '+');
+        },
+        RFC3986: function (value) {
+            return value;
+        }
+    },
     RFC1738: 'RFC1738',
     RFC3986: 'RFC3986'
 };
 
-module.exports = util.assign(
-    {
-        'default': Format.RFC3986,
-        formatters: {
-            RFC1738: function (value) {
-                return replace.call(value, percentTwenties, '+');
-            },
-            RFC3986: function (value) {
-                return String(value);
-            }
-        }
-    },
-    Format
-);
-
-},{"./utils":5}],2:[function(require,module,exports){
+},{}],2:[function(require,module,exports){
 'use strict';
 
 var stringify = require('./stringify');
@@ -52,6 +44,7 @@ var defaults = {
     arrayLimit: 20,
     charset: 'utf-8',
     charsetSentinel: false,
+    comma: false,
     decoder: utils.decode,
     delimiter: '&',
     depth: 5,
@@ -123,6 +116,11 @@ var parseValues = function parseQueryStringValues(str, options) {
         if (val && options.interpretNumericEntities && charset === 'iso-8859-1') {
             val = interpretNumericEntities(val);
         }
+
+        if (val && options.comma && val.indexOf(',') > -1) {
+            val = val.split(',');
+        }
+
         if (has.call(obj, key)) {
             obj[key] = utils.combine(obj[key], val);
         } else {
@@ -157,7 +155,7 @@ var parseObject = function (chain, val, options) {
             ) {
                 obj = [];
                 obj[index] = leaf;
-            } else if (cleanRoot !== '__proto__') {
+            } else {
                 obj[cleanRoot] = leaf;
             }
         }
@@ -242,6 +240,7 @@ var normalizeParseOptions = function normalizeParseOptions(opts) {
         arrayLimit: typeof opts.arrayLimit === 'number' ? opts.arrayLimit : defaults.arrayLimit,
         charset: charset,
         charsetSentinel: typeof opts.charsetSentinel === 'boolean' ? opts.charsetSentinel : defaults.charsetSentinel,
+        comma: typeof opts.comma === 'boolean' ? opts.comma : defaults.comma,
         decoder: typeof opts.decoder === 'function' ? opts.decoder : defaults.decoder,
         delimiter: typeof opts.delimiter === 'string' || utils.isRegExp(opts.delimiter) ? opts.delimiter : defaults.delimiter,
         depth: typeof opts.depth === 'number' ? opts.depth : defaults.depth,
@@ -284,13 +283,14 @@ var formats = require('./formats');
 var has = Object.prototype.hasOwnProperty;
 
 var arrayPrefixGenerators = {
-    brackets: function brackets(prefix) {
+    brackets: function brackets(prefix) { // eslint-disable-line func-name-matching
         return prefix + '[]';
     },
-    indices: function indices(prefix, key) {
+    comma: 'comma',
+    indices: function indices(prefix, key) { // eslint-disable-line func-name-matching
         return prefix + '[' + key + ']';
     },
-    repeat: function repeat(prefix) {
+    repeat: function repeat(prefix) { // eslint-disable-line func-name-matching
         return prefix;
     }
 };
@@ -303,7 +303,6 @@ var pushToArray = function (arr, valueOrArray) {
 
 var toISO = Date.prototype.toISOString;
 
-var defaultFormat = formats['default'];
 var defaults = {
     addQueryPrefix: false,
     allowDots: false,
@@ -313,18 +312,17 @@ var defaults = {
     encode: true,
     encoder: utils.encode,
     encodeValuesOnly: false,
-    format: defaultFormat,
-    formatter: formats.formatters[defaultFormat],
+    formatter: formats.formatters[formats['default']],
     // deprecated
     indices: false,
-    serializeDate: function serializeDate(date) {
+    serializeDate: function serializeDate(date) { // eslint-disable-line func-name-matching
         return toISO.call(date);
     },
     skipNulls: false,
     strictNullHandling: false
 };
 
-var stringify = function stringify(
+var stringify = function stringify( // eslint-disable-line func-name-matching
     object,
     prefix,
     generateArrayPrefix,
@@ -344,6 +342,8 @@ var stringify = function stringify(
         obj = filter(prefix, obj);
     } else if (obj instanceof Date) {
         obj = serializeDate(obj);
+    } else if (generateArrayPrefix === 'comma' && isArray(obj)) {
+        obj = obj.join(',');
     }
 
     if (obj === null) {
@@ -386,7 +386,7 @@ var stringify = function stringify(
         if (isArray(obj)) {
             pushToArray(values, stringify(
                 obj[key],
-                generateArrayPrefix(prefix, key),
+                typeof generateArrayPrefix === 'function' ? generateArrayPrefix(prefix, key) : prefix,
                 generateArrayPrefix,
                 strictNullHandling,
                 skipNulls,
@@ -426,7 +426,7 @@ var normalizeStringifyOptions = function normalizeStringifyOptions(opts) {
         return defaults;
     }
 
-    if (opts.encoder !== null && typeof opts.encoder !== 'undefined' && typeof opts.encoder !== 'function') {
+    if (opts.encoder !== null && opts.encoder !== undefined && typeof opts.encoder !== 'function') {
         throw new TypeError('Encoder has to be a function.');
     }
 

package/lib/formats.js

@@ -3,24 +3,16 @@
 var replace = String.prototype.replace;
 var percentTwenties = /%20/g;
 
-var util = require('./utils');
-
-var Format = {
+module.exports = {
+    'default': 'RFC3986',
+    formatters: {
+        RFC1738: function (value) {
+            return replace.call(value, percentTwenties, '+');
+        },
+        RFC3986: function (value) {
+            return value;
+        }
+    },
     RFC1738: 'RFC1738',
     RFC3986: 'RFC3986'
 };
-
-module.exports = util.assign(
-    {
-        'default': Format.RFC3986,
-        formatters: {
-            RFC1738: function (value) {
-                return replace.call(value, percentTwenties, '+');
-            },
-            RFC3986: function (value) {
-                return String(value);
-            }
-        }
-    },
-    Format
-);

package/lib/parse.js

@@ -10,6 +10,7 @@ var defaults = {
     arrayLimit: 20,
     charset: 'utf-8',
     charsetSentinel: false,
+    comma: false,
     decoder: utils.decode,
     delimiter: '&',
     depth: 5,
@@ -81,6 +82,11 @@ var parseValues = function parseQueryStringValues(str, options) {
         if (val && options.interpretNumericEntities && charset === 'iso-8859-1') {
             val = interpretNumericEntities(val);
         }
+
+        if (val && options.comma && val.indexOf(',') > -1) {
+            val = val.split(',');
+        }
+
         if (has.call(obj, key)) {
             obj[key] = utils.combine(obj[key], val);
         } else {
@@ -115,7 +121,7 @@ var parseObject = function (chain, val, options) {
             ) {
                 obj = [];
                 obj[index] = leaf;
-            } else if (cleanRoot !== '__proto__') {
+            } else {
                 obj[cleanRoot] = leaf;
             }
         }
@@ -200,6 +206,7 @@ var normalizeParseOptions = function normalizeParseOptions(opts) {
         arrayLimit: typeof opts.arrayLimit === 'number' ? opts.arrayLimit : defaults.arrayLimit,
         charset: charset,
         charsetSentinel: typeof opts.charsetSentinel === 'boolean' ? opts.charsetSentinel : defaults.charsetSentinel,
+        comma: typeof opts.comma === 'boolean' ? opts.comma : defaults.comma,
         decoder: typeof opts.decoder === 'function' ? opts.decoder : defaults.decoder,
         delimiter: typeof opts.delimiter === 'string' || utils.isRegExp(opts.delimiter) ? opts.delimiter : defaults.delimiter,
         depth: typeof opts.depth === 'number' ? opts.depth : defaults.depth,

package/lib/stringify.js

@@ -5,13 +5,14 @@ var formats = require('./formats');
 var has = Object.prototype.hasOwnProperty;
 
 var arrayPrefixGenerators = {
-    brackets: function brackets(prefix) {
+    brackets: function brackets(prefix) { // eslint-disable-line func-name-matching
         return prefix + '[]';
     },
-    indices: function indices(prefix, key) {
+    comma: 'comma',
+    indices: function indices(prefix, key) { // eslint-disable-line func-name-matching
         return prefix + '[' + key + ']';
     },
-    repeat: function repeat(prefix) {
+    repeat: function repeat(prefix) { // eslint-disable-line func-name-matching
         return prefix;
     }
 };
@@ -24,7 +25,6 @@ var pushToArray = function (arr, valueOrArray) {
 
 var toISO = Date.prototype.toISOString;
 
-var defaultFormat = formats['default'];
 var defaults = {
     addQueryPrefix: false,
     allowDots: false,
@@ -34,18 +34,17 @@ var defaults = {
     encode: true,
     encoder: utils.encode,
     encodeValuesOnly: false,
-    format: defaultFormat,
-    formatter: formats.formatters[defaultFormat],
+    formatter: formats.formatters[formats['default']],
     // deprecated
     indices: false,
-    serializeDate: function serializeDate(date) {
+    serializeDate: function serializeDate(date) { // eslint-disable-line func-name-matching
         return toISO.call(date);
     },
     skipNulls: false,
     strictNullHandling: false
 };
 
-var stringify = function stringify(
+var stringify = function stringify( // eslint-disable-line func-name-matching
     object,
     prefix,
     generateArrayPrefix,
@@ -65,6 +64,8 @@ var stringify = function stringify(
         obj = filter(prefix, obj);
     } else if (obj instanceof Date) {
         obj = serializeDate(obj);
+    } else if (generateArrayPrefix === 'comma' && isArray(obj)) {
+        obj = obj.join(',');
     }
 
     if (obj === null) {
@@ -107,7 +108,7 @@ var stringify = function stringify(
         if (isArray(obj)) {
             pushToArray(values, stringify(
                 obj[key],
-                generateArrayPrefix(prefix, key),
+                typeof generateArrayPrefix === 'function' ? generateArrayPrefix(prefix, key) : prefix,
                 generateArrayPrefix,
                 strictNullHandling,
                 skipNulls,
@@ -147,7 +148,7 @@ var normalizeStringifyOptions = function normalizeStringifyOptions(opts) {
         return defaults;
     }
 
-    if (opts.encoder !== null && typeof opts.encoder !== 'undefined' && typeof opts.encoder !== 'function') {
+    if (opts.encoder !== null && opts.encoder !== undefined && typeof opts.encoder !== 'function') {
         throw new TypeError('Encoder has to be a function.');
     }
 

package/package.json

@@ -2,7 +2,7 @@
     "name": "qs",
     "description": "A querystring parser that supports nesting and arrays, with a depth limit",
     "homepage": "https://github.com/ljharb/qs",
-    "version": "6.6.1",
+    "version": "6.7.0",
     "repository": {
         "type": "git",
         "url": "https://github.com/ljharb/qs.git"
@@ -17,39 +17,41 @@
     ],
     "keywords": [
         "querystring",
-        "qs"
+        "qs",
+        "query",
+        "url",
+        "parse",
+        "stringify"
     ],
     "engines": {
         "node": ">=0.6"
     },
+    "dependencies": {},
     "devDependencies": {
-        "@ljharb/eslint-config": "^20.1.0",
-        "aud": "^1.1.5",
-        "browserify": "^16.5.2",
-        "eclint": "^2.8.1",
-        "eslint": "^8.6.0",
+        "@ljharb/eslint-config": "^13.1.1",
+        "browserify": "^16.2.3",
+        "covert": "^1.1.1",
+        "editorconfig-tools": "^0.1.1",
+        "eslint": "^5.15.3",
         "evalmd": "^0.0.17",
         "for-each": "^0.3.3",
         "iconv-lite": "^0.4.24",
-        "in-publish": "^2.0.1",
         "mkdirp": "^0.5.1",
-        "nyc": "^10.3.2",
-        "object-inspect": "^1.12.0",
+        "object-inspect": "^1.6.0",
         "qs-iconv": "^1.0.4",
-        "safe-publish-latest": "^2.0.0",
+        "safe-publish-latest": "^1.1.2",
         "safer-buffer": "^2.1.2",
-        "tape": "^4.14.0"
+        "tape": "^4.10.1"
     },
     "scripts": {
-        "prepublishOnly": "safe-publish-latest && npm run dist",
-        "prepublish": "not-in-publish || npm run prepublishOnly",
+        "prepublish": "safe-publish-latest && npm run dist",
         "pretest": "npm run --silent readme && npm run --silent lint",
-        "test": "npm run --silent tests-only",
-        "tests-only": "nyc tape 'test/**/*.js'",
-        "posttest": "aud --production",
+        "test": "npm run --silent coverage",
+        "tests-only": "node test",
         "readme": "evalmd README.md",
-        "postlint": "eclint check $(git ls-files | xargs find 2> /dev/null | grep -vE 'node_modules|\\.git')",
-        "lint": "eslint --ext=js,mjs .",
+        "postlint": "editorconfig-tools check * lib/* test/*",
+        "lint": "eslint lib/*.js test/*.js",
+        "coverage": "covert test",
         "dist": "mkdirp dist && browserify --standalone Qs lib/index.js > dist/qs.js"
     },
     "license": "BSD-3-Clause"

package/test/.eslintrc

@@ -0,0 +1,17 @@
+{
+    "rules": {
+		"array-bracket-newline": 0,
+		"array-element-newline": 0,
+		"consistent-return": 2,
+        "function-paren-newline": 0,
+        "max-lines": 0,
+        "max-lines-per-function": 0,
+        "max-nested-callbacks": [2, 3],
+        "max-statements": 0,
+		"no-buffer-constructor": 0,
+        "no-extend-native": 0,
+        "no-magic-numbers": 0,
+		"object-curly-newline": 0,
+        "sort-keys": 0
+    }
+}

package/test/parse.js

@@ -347,6 +347,15 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('parses string with comma as array divider', function (st) {
+        st.deepEqual(qs.parse('foo=bar,tee', { comma: true }), { foo: ['bar', 'tee'] });
+        st.deepEqual(qs.parse('foo[bar]=coffee,tee', { comma: true }), { foo: { bar: ['coffee', 'tee'] } });
+        st.deepEqual(qs.parse('foo=', { comma: true }), { foo: '' });
+        st.deepEqual(qs.parse('foo', { comma: true }), { foo: '' });
+        st.deepEqual(qs.parse('foo', { comma: true, strictNullHandling: true }), { foo: null });
+        st.end();
+    });
+
     t.test('parses an object in dot notation', function (st) {
         var input = {
             'user.name': { 'pop[bob]': 3 },
@@ -530,66 +539,6 @@ test('parse()', function (t) {
         st.end();
     });
 
-    t.test('dunder proto is ignored', function (st) {
-        var payload = 'categories[__proto__]=login&categories[__proto__]&categories[length]=42';
-        var result = qs.parse(payload, { allowPrototypes: true });
-
-        st.deepEqual(
-            result,
-            {
-                categories: {
-                    length: '42'
-                }
-            },
-            'silent [[Prototype]] payload'
-        );
-
-        var plainResult = qs.parse(payload, { allowPrototypes: true, plainObjects: true });
-
-        st.deepEqual(
-            plainResult,
-            {
-                __proto__: null,
-                categories: {
-                    __proto__: null,
-                    length: '42'
-                }
-            },
-            'silent [[Prototype]] payload: plain objects'
-        );
-
-        var query = qs.parse('categories[__proto__]=cats&categories[__proto__]=dogs&categories[some][json]=toInject', { allowPrototypes: true });
-
-        st.notOk(Array.isArray(query.categories), 'is not an array');
-        st.notOk(query.categories instanceof Array, 'is not instanceof an array');
-        st.deepEqual(query.categories, { some: { json: 'toInject' } });
-        st.equal(JSON.stringify(query.categories), '{"some":{"json":"toInject"}}', 'stringifies as a non-array');
-
-        st.deepEqual(
-            qs.parse('foo[__proto__][hidden]=value&foo[bar]=stuffs', { allowPrototypes: true }),
-            {
-                foo: {
-                    bar: 'stuffs'
-                }
-            },
-            'hidden values'
-        );
-
-        st.deepEqual(
-            qs.parse('foo[__proto__][hidden]=value&foo[bar]=stuffs', { allowPrototypes: true, plainObjects: true }),
-            {
-                __proto__: null,
-                foo: {
-                    __proto__: null,
-                    bar: 'stuffs'
-                }
-            },
-            'hidden values: plain objects'
-        );
-
-        st.end();
-    });
-
     t.test('can return null objects', { skip: !Object.create }, function (st) {
         var expected = Object.create(null);
         expected.a = Object.create(null);

package/test/stringify.js

@@ -68,6 +68,11 @@ test('stringify()', function (t) {
             'a%5B%5D=b&a%5B%5D=c&a%5B%5D=d',
             'brackets => brackets'
         );
+        st.equal(
+            qs.stringify({ a: ['b', 'c', 'd'] }, { arrayFormat: 'comma' }),
+            'a=b%2Cc%2Cd',
+            'comma => comma'
+        );
         st.equal(
             qs.stringify({ a: ['b', 'c', 'd'] }),
             'a%5B0%5D=b&a%5B1%5D=c&a%5B2%5D=d',
@@ -94,6 +99,7 @@ test('stringify()', function (t) {
     t.test('stringifies a nested array value', function (st) {
         st.equal(qs.stringify({ a: { b: ['c', 'd'] } }, { arrayFormat: 'indices' }), 'a%5Bb%5D%5B0%5D=c&a%5Bb%5D%5B1%5D=d');
         st.equal(qs.stringify({ a: { b: ['c', 'd'] } }, { arrayFormat: 'brackets' }), 'a%5Bb%5D%5B%5D=c&a%5Bb%5D%5B%5D=d');
+        st.equal(qs.stringify({ a: { b: ['c', 'd'] } }, { arrayFormat: 'comma' }), 'a%5Bb%5D=c%2Cd'); // a[b]=c,d
         st.equal(qs.stringify({ a: { b: ['c', 'd'] } }), 'a%5Bb%5D%5B0%5D=c&a%5Bb%5D%5B1%5D=d');
         st.end();
     });
@@ -115,6 +121,14 @@ test('stringify()', function (t) {
             'a.b[]=c&a.b[]=d',
             'brackets: stringifies with dots + brackets'
         );
+        st.equal(
+            qs.stringify(
+                { a: { b: ['c', 'd'] } },
+                { allowDots: true, encode: false, arrayFormat: 'comma' }
+            ),
+            'a.b=c,d',
+            'comma: stringifies with dots + comma'
+        );
         st.equal(
             qs.stringify(
                 { a: { b: ['c', 'd'] } },
@@ -129,12 +143,12 @@ test('stringify()', function (t) {
     t.test('stringifies an object inside an array', function (st) {
         st.equal(
             qs.stringify({ a: [{ b: 'c' }] }, { arrayFormat: 'indices' }),
-            'a%5B0%5D%5Bb%5D=c',
+            'a%5B0%5D%5Bb%5D=c', // a[0][b]=c
             'indices => brackets'
         );
         st.equal(
             qs.stringify({ a: [{ b: 'c' }] }, { arrayFormat: 'brackets' }),
-            'a%5B%5D%5Bb%5D=c',
+            'a%5B%5D%5Bb%5D=c', // a[][b]=c
             'brackets => brackets'
         );
         st.equal(
@@ -506,12 +520,6 @@ test('stringify()', function (t) {
                 return String.fromCharCode(buffer.readUInt8(0) + 97);
             }
         }), 'a=b');
-
-        st.equal(qs.stringify({ a: SaferBuffer.from('a b') }, {
-            encoder: function (buffer) {
-                return buffer;
-            }
-        }), 'a=a b');
         st.end();
     });
 
@@ -552,20 +560,17 @@ test('stringify()', function (t) {
     t.test('RFC 1738 spaces serialization', function (st) {
         st.equal(qs.stringify({ a: 'b c' }, { format: qs.formats.RFC1738 }), 'a=b+c');
         st.equal(qs.stringify({ 'a b': 'c d' }, { format: qs.formats.RFC1738 }), 'a+b=c+d');
-        st.equal(qs.stringify({ 'a b': SaferBuffer.from('a b') }, { format: qs.formats.RFC1738 }), 'a+b=a+b');
         st.end();
     });
 
     t.test('RFC 3986 spaces serialization', function (st) {
         st.equal(qs.stringify({ a: 'b c' }, { format: qs.formats.RFC3986 }), 'a=b%20c');
         st.equal(qs.stringify({ 'a b': 'c d' }, { format: qs.formats.RFC3986 }), 'a%20b=c%20d');
-        st.equal(qs.stringify({ 'a b': SaferBuffer.from('a b') }, { format: qs.formats.RFC3986 }), 'a%20b=a%20b');
         st.end();
     });
 
     t.test('Backward compatibility to RFC 3986', function (st) {
         st.equal(qs.stringify({ a: 'b c' }), 'a=b%20c');
-        st.equal(qs.stringify({ 'a b': SaferBuffer.from('a b') }), 'a%20b=a%20b');
         st.end();
     });
 

package/.github/FUNDING.yml

@@ -1,12 +0,0 @@
-# These are supported funding model platforms
-
-github: [ljharb]
-patreon: # Replace with a single Patreon username
-open_collective: # Replace with a single Open Collective username
-ko_fi: # Replace with a single Ko-fi username
-tidelift: npm/qs
-community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
-liberapay: # Replace with a single Liberapay username
-issuehunt: # Replace with a single IssueHunt username
-otechie: # Replace with a single Otechie username
-custom: # Replace with a single custom sponsorship URL

package/.nycrc

@@ -1,13 +0,0 @@
-{
-	"all": true,
-	"check-coverage": false,
-	"reporter": ["text-summary", "text", "html", "json"],
-	"lines": 86,
-	"statements": 85.93,
-	"functions": 82.43,
-	"branches": 76.06,
-	"exclude": [
-		"coverage",
-		"dist"
-	]
-}

package/LICENSE.md

@@ -1,29 +0,0 @@
-BSD 3-Clause License
-
-Copyright (c) 2014, Nathan LaFreniere and other [contributors](https://github.com/ljharb/qs/graphs/contributors)
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-1. Redistributions of source code must retain the above copyright notice, this
-   list of conditions and the following disclaimer.
-
-2. Redistributions in binary form must reproduce the above copyright notice,
-   this list of conditions and the following disclaimer in the documentation
-   and/or other materials provided with the distribution.
-
-3. Neither the name of the copyright holder nor the names of its
-   contributors may be used to endorse or promote products derived from
-   this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.