query-string 9.4.1 → 9.5.1

package/base.js

@@ -395,10 +395,17 @@ export function parse(query, options) {
 		return returnValue;
 	}
 
-	// Avoid `split('&')` so separator-heavy inputs don't allocate large arrays of empty strings.
+	if (/^&+$/.test(query)) {
+		return returnValue;
+	}
+
 	let parameterStart = 0;
+	let firstSeparator = query.indexOf('&');
+	if (firstSeparator === -1) {
+		firstSeparator = query.length;
+	}
 
-	for (let index = 0; index <= query.length; index++) {
+	for (let index = firstSeparator; index <= query.length; index++) {
 		if (index < query.length && query[index] !== '&') {
 			continue;
 		}
@@ -409,7 +416,6 @@ export function parse(query, options) {
 		}
 
 		const parameter = query.slice(parameterStart, index);
-		parameterStart = index + 1;
 		const parameter_ = options.decode ? parameter.replaceAll('+', ' ') : parameter;
 
 		let [key, value] = splitOnFirst(parameter_, '=');
@@ -422,6 +428,8 @@ export function parse(query, options) {
 		// http://w3.org/TR/2012/WD-url-20120524/#collect-url-parameters
 		value = value === undefined ? null : (['comma', 'separator', 'bracket-separator'].includes(options.arrayFormat) ? value : decode(value, options));
 		formatter(decode(key, options), value, returnValue);
+
+		parameterStart = index + 1;
 	}
 
 	for (const [key, value] of Object.entries(returnValue)) {
@@ -571,9 +579,14 @@ export function stringifyUrl(object, options) {
 
 	let hash = getHash(object.url);
 	if (typeof object.fragmentIdentifier === 'string') {
-		const urlObjectForFragmentEncode = new URL(url, 'https://query-string.invalid');
-		urlObjectForFragmentEncode.hash = object.fragmentIdentifier;
-		hash = options[encodeFragmentIdentifier] ? urlObjectForFragmentEncode.hash : `#${object.fragmentIdentifier}`;
+		hash = `#${object.fragmentIdentifier}`;
+
+		if (options[encodeFragmentIdentifier]) {
+			// Percent-encode the fragment with a throwaway URL. The fragment percent-encode set does not depend on the scheme, so the caller's URL is deliberately not parsed here; it may not even be parseable.
+			const throwawayUrl = new URL('https://query-string.invalid');
+			throwawayUrl.hash = hash;
+			hash = throwawayUrl.hash;
+		}
 	}
 
 	return `${url}${queryString}${hash}`;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "query-string",
-	"version": "9.4.1",
+	"version": "9.5.1",
 	"description": "Parse and stringify URL query strings",
 	"license": "MIT",
 	"repository": "sindresorhus/query-string",
@@ -46,7 +46,7 @@
 		"filter"
 	],
 	"dependencies": {
-		"decode-uri-component": "^0.4.1",
+		"decode-uri-component": "^0.5.0",
 		"filter-obj": "^5.1.0",
 		"split-on-first": "^3.0.0"
 	},