step-node-agent 3.29.1 → 3.29.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (111) hide show
  1. package/node_modules/har-validator/node_modules/ajv/README.md +14 -6
  2. package/node_modules/har-validator/node_modules/ajv/dist/ajv.bundle.js +23 -11
  3. package/node_modules/har-validator/node_modules/ajv/dist/ajv.min.js +2 -2
  4. package/node_modules/har-validator/node_modules/ajv/dist/ajv.min.js.map +1 -1
  5. package/node_modules/har-validator/node_modules/ajv/lib/ajv.d.ts +5 -0
  6. package/node_modules/har-validator/node_modules/ajv/lib/compile/index.js +8 -6
  7. package/node_modules/har-validator/node_modules/ajv/lib/dot/pattern.jst +15 -4
  8. package/node_modules/har-validator/node_modules/ajv/lib/dotjs/pattern.js +14 -4
  9. package/node_modules/har-validator/node_modules/ajv/package.json +2 -1
  10. package/node_modules/har-validator/node_modules/ajv/scripts/info +0 -0
  11. package/node_modules/har-validator/node_modules/ajv/scripts/prepare-tests +0 -0
  12. package/node_modules/har-validator/node_modules/ajv/scripts/publish-built-version +0 -0
  13. package/node_modules/har-validator/node_modules/ajv/scripts/travis-gh-pages +0 -0
  14. package/node_modules/minimatch/README.md +37 -0
  15. package/node_modules/minimatch/minimatch.js +160 -102
  16. package/node_modules/minimatch/package.json +2 -2
  17. package/node_modules/qs/.editorconfig +1 -1
  18. package/node_modules/qs/.github/SECURITY.md +11 -0
  19. package/node_modules/qs/.github/THREAT_MODEL.md +78 -0
  20. package/node_modules/qs/CHANGELOG.md +22 -0
  21. package/node_modules/qs/README.md +11 -4
  22. package/node_modules/qs/dist/qs.js +24 -24
  23. package/node_modules/qs/eslint.config.mjs +56 -0
  24. package/node_modules/qs/lib/parse.js +90 -47
  25. package/node_modules/qs/lib/utils.js +83 -11
  26. package/node_modules/qs/package.json +9 -8
  27. package/node_modules/qs/test/parse.js +245 -9
  28. package/node_modules/qs/test/stringify.js +7 -3
  29. package/node_modules/qs/test/utils.js +135 -0
  30. package/node_modules/request/node_modules/qs/CHANGELOG.md +12 -0
  31. package/node_modules/request/node_modules/qs/README.md +9 -3
  32. package/node_modules/request/node_modules/qs/dist/qs.js +10 -10
  33. package/node_modules/request/node_modules/qs/lib/parse.js +4 -4
  34. package/node_modules/request/node_modules/qs/lib/utils.js +6 -6
  35. package/node_modules/request/node_modules/qs/package.json +13 -4
  36. package/node_modules/request/node_modules/qs/test/parse.js +9 -0
  37. package/node_modules/request/node_modules/qs/test/stringify.js +6 -0
  38. package/node_modules/send/HISTORY.md +7 -0
  39. package/node_modules/send/package.json +5 -5
  40. package/node_modules/serve-static/HISTORY.md +6 -0
  41. package/node_modules/serve-static/package.json +2 -2
  42. package/node_modules/underscore/amd/_setup.js +1 -1
  43. package/node_modules/underscore/amd/pipe.js +13 -0
  44. package/node_modules/underscore/cjs/_setup.js +1 -1
  45. package/node_modules/underscore/cjs/pipe.js +12 -0
  46. package/node_modules/underscore/modules/_flatten.js +20 -18
  47. package/node_modules/underscore/modules/_setup.js +1 -1
  48. package/node_modules/underscore/modules/index.js +2 -2
  49. package/node_modules/underscore/modules/isEqual.js +108 -93
  50. package/node_modules/underscore/modules/package.json +1 -1
  51. package/node_modules/underscore/package.json +1 -1
  52. package/node_modules/underscore/underscore-esm-min.js +3 -3
  53. package/node_modules/underscore/underscore-esm-min.js.map +1 -1
  54. package/node_modules/underscore/underscore-esm.js +132 -115
  55. package/node_modules/underscore/underscore-esm.js.map +1 -1
  56. package/node_modules/underscore/underscore-min.js +3 -3
  57. package/node_modules/underscore/underscore-min.js.map +1 -1
  58. package/node_modules/underscore/underscore-node-f.cjs +132 -115
  59. package/node_modules/underscore/underscore-node-f.cjs.map +1 -1
  60. package/node_modules/underscore/underscore-node.cjs +2 -2
  61. package/node_modules/underscore/underscore-node.mjs +2 -2
  62. package/node_modules/underscore/underscore-umd-min.js +3 -3
  63. package/node_modules/underscore/underscore-umd-min.js.map +1 -1
  64. package/node_modules/underscore/underscore-umd.js +132 -115
  65. package/node_modules/underscore/underscore-umd.js.map +1 -1
  66. package/node_modules/underscore/underscore.js +132 -115
  67. package/package.json +1 -1
  68. package/node_modules/qs/.eslintrc +0 -39
  69. package/node_modules/request/node_modules/qs/bower.json +0 -21
  70. package/node_modules/request/node_modules/qs/component.json +0 -15
  71. package/node_modules/send/node_modules/http-errors/HISTORY.md +0 -180
  72. package/node_modules/send/node_modules/http-errors/LICENSE +0 -23
  73. package/node_modules/send/node_modules/http-errors/README.md +0 -169
  74. package/node_modules/send/node_modules/http-errors/index.js +0 -289
  75. package/node_modules/send/node_modules/http-errors/package.json +0 -50
  76. package/node_modules/send/node_modules/statuses/HISTORY.md +0 -82
  77. package/node_modules/send/node_modules/statuses/LICENSE +0 -23
  78. package/node_modules/send/node_modules/statuses/README.md +0 -136
  79. package/node_modules/send/node_modules/statuses/codes.json +0 -65
  80. package/node_modules/send/node_modules/statuses/index.js +0 -146
  81. package/node_modules/send/node_modules/statuses/package.json +0 -49
  82. package/node_modules/serve-static/node_modules/http-errors/HISTORY.md +0 -180
  83. package/node_modules/serve-static/node_modules/http-errors/LICENSE +0 -23
  84. package/node_modules/serve-static/node_modules/http-errors/README.md +0 -169
  85. package/node_modules/serve-static/node_modules/http-errors/index.js +0 -289
  86. package/node_modules/serve-static/node_modules/http-errors/package.json +0 -50
  87. package/node_modules/serve-static/node_modules/ms/index.js +0 -162
  88. package/node_modules/serve-static/node_modules/ms/license.md +0 -21
  89. package/node_modules/serve-static/node_modules/ms/package.json +0 -38
  90. package/node_modules/serve-static/node_modules/ms/readme.md +0 -59
  91. package/node_modules/serve-static/node_modules/send/HISTORY.md +0 -526
  92. package/node_modules/serve-static/node_modules/send/LICENSE +0 -23
  93. package/node_modules/serve-static/node_modules/send/README.md +0 -327
  94. package/node_modules/serve-static/node_modules/send/SECURITY.md +0 -24
  95. package/node_modules/serve-static/node_modules/send/index.js +0 -1142
  96. package/node_modules/serve-static/node_modules/send/node_modules/encodeurl/HISTORY.md +0 -14
  97. package/node_modules/serve-static/node_modules/send/node_modules/encodeurl/LICENSE +0 -22
  98. package/node_modules/serve-static/node_modules/send/node_modules/encodeurl/README.md +0 -128
  99. package/node_modules/serve-static/node_modules/send/node_modules/encodeurl/index.js +0 -60
  100. package/node_modules/serve-static/node_modules/send/node_modules/encodeurl/package.json +0 -40
  101. package/node_modules/serve-static/node_modules/send/package.json +0 -62
  102. package/node_modules/serve-static/node_modules/statuses/HISTORY.md +0 -82
  103. package/node_modules/serve-static/node_modules/statuses/LICENSE +0 -23
  104. package/node_modules/serve-static/node_modules/statuses/README.md +0 -136
  105. package/node_modules/serve-static/node_modules/statuses/codes.json +0 -65
  106. package/node_modules/serve-static/node_modules/statuses/index.js +0 -146
  107. package/node_modules/serve-static/node_modules/statuses/package.json +0 -49
  108. package/node_modules/underscore/amd/_set.js +0 -21
  109. package/node_modules/underscore/amd/set.js +0 -15
  110. package/node_modules/underscore/cjs/_set.js +0 -21
  111. package/node_modules/underscore/cjs/set.js +0 -15
@@ -235,11 +235,11 @@ test('parse()', function (t) {
235
235
  st.deepEqual(qs.parse('a=b&a[0]=c'), { a: ['b', 'c'] });
236
236
 
237
237
  st.deepEqual(qs.parse('a[1]=b&a=c', { arrayLimit: 20 }), { a: ['b', 'c'] });
238
- st.deepEqual(qs.parse('a[]=b&a=c', { arrayLimit: 0 }), { a: ['b', 'c'] });
238
+ st.deepEqual(qs.parse('a[]=b&a=c', { arrayLimit: 0 }), { a: { 0: 'b', 1: 'c' } });
239
239
  st.deepEqual(qs.parse('a[]=b&a=c'), { a: ['b', 'c'] });
240
240
 
241
241
  st.deepEqual(qs.parse('a=b&a[1]=c', { arrayLimit: 20 }), { a: ['b', 'c'] });
242
- st.deepEqual(qs.parse('a=b&a[]=c', { arrayLimit: 0 }), { a: ['b', 'c'] });
242
+ st.deepEqual(qs.parse('a=b&a[]=c', { arrayLimit: 0 }), { a: { 0: 'b', 1: 'c' } });
243
243
  st.deepEqual(qs.parse('a=b&a[]=c'), { a: ['b', 'c'] });
244
244
 
245
245
  st.end();
@@ -261,11 +261,11 @@ test('parse()', function (t) {
261
261
  });
262
262
 
263
263
  t.test('limits specific array indices to arrayLimit', function (st) {
264
- st.deepEqual(qs.parse('a[20]=a', { arrayLimit: 20 }), { a: ['a'] });
265
- st.deepEqual(qs.parse('a[21]=a', { arrayLimit: 20 }), { a: { 21: 'a' } });
264
+ st.deepEqual(qs.parse('a[19]=a', { arrayLimit: 20 }), { a: ['a'] });
265
+ st.deepEqual(qs.parse('a[20]=a', { arrayLimit: 20 }), { a: { 20: 'a' } });
266
266
 
267
- st.deepEqual(qs.parse('a[20]=a'), { a: ['a'] });
268
- st.deepEqual(qs.parse('a[21]=a'), { a: { 21: 'a' } });
267
+ st.deepEqual(qs.parse('a[19]=a'), { a: ['a'] });
268
+ st.deepEqual(qs.parse('a[20]=a'), { a: { 20: 'a' } });
269
269
  st.end();
270
270
  });
271
271
 
@@ -364,7 +364,7 @@ test('parse()', function (t) {
364
364
  );
365
365
  st.deepEqual(
366
366
  qs.parse('a[]=b&a[]&a[]=c&a[]=', { strictNullHandling: true, arrayLimit: 0 }),
367
- { a: ['b', null, 'c', ''] },
367
+ { a: { 0: 'b', 1: null, 2: 'c', 3: '' } },
368
368
  'with arrayLimit 0 + array brackets: null then empty string works'
369
369
  );
370
370
 
@@ -375,7 +375,7 @@ test('parse()', function (t) {
375
375
  );
376
376
  st.deepEqual(
377
377
  qs.parse('a[]=b&a[]=&a[]=c&a[]', { strictNullHandling: true, arrayLimit: 0 }),
378
- { a: ['b', '', 'c', null] },
378
+ { a: { 0: 'b', 1: '', 2: 'c', 3: null } },
379
379
  'with arrayLimit 0 + array brackets: empty string then null works'
380
380
  );
381
381
 
@@ -483,7 +483,7 @@ test('parse()', function (t) {
483
483
 
484
484
  t.test('allows overriding array limit', function (st) {
485
485
  st.deepEqual(qs.parse('a[0]=b', { arrayLimit: -1 }), { a: { 0: 'b' } });
486
- st.deepEqual(qs.parse('a[0]=b', { arrayLimit: 0 }), { a: ['b'] });
486
+ st.deepEqual(qs.parse('a[0]=b', { arrayLimit: 0 }), { a: { 0: 'b' } });
487
487
 
488
488
  st.deepEqual(qs.parse('a[-1]=b', { arrayLimit: -1 }), { a: { '-1': 'b' } });
489
489
  st.deepEqual(qs.parse('a[-1]=b', { arrayLimit: 0 }), { a: { '-1': 'b' } });
@@ -996,6 +996,20 @@ test('parse()', function (t) {
996
996
  st.end();
997
997
  });
998
998
 
999
+ t.test('handles a custom decoder returning `null`, with a string key of `null`', function (st) {
1000
+ st.deepEqual(
1001
+ qs.parse('null=1&ToNull=2', {
1002
+ decoder: function (str, defaultDecoder, charset) {
1003
+ return str === 'ToNull' ? null : defaultDecoder(str, defaultDecoder, charset);
1004
+ }
1005
+ }),
1006
+ { 'null': '1' },
1007
+ '"null" key is not overridden by `null` decoder result'
1008
+ );
1009
+
1010
+ st.end();
1011
+ });
1012
+
999
1013
  t.test('does not interpret numeric entities in iso-8859-1 when `interpretNumericEntities` is absent', function (st) {
1000
1014
  st.deepEqual(qs.parse('foo=' + urlEncodedNumSmiley, { charset: 'iso-8859-1' }), { foo: '☺' });
1001
1015
  st.end();
@@ -1104,6 +1118,7 @@ test('parse()', function (t) {
1104
1118
  });
1105
1119
 
1106
1120
  st.test('throws error when array limit exceeded', function (sst) {
1121
+ // 4 elements exceeds limit of 3
1107
1122
  sst['throws'](
1108
1123
  function () {
1109
1124
  qs.parse('a[]=1&a[]=2&a[]=3&a[]=4', { arrayLimit: 3, throwOnLimitExceeded: true });
@@ -1114,6 +1129,14 @@ test('parse()', function (t) {
1114
1129
  sst.end();
1115
1130
  });
1116
1131
 
1132
+ st.test('does not throw when at limit', function (sst) {
1133
+ // 3 elements = limit of 3, should not throw
1134
+ var result = qs.parse('a[]=1&a[]=2&a[]=3', { arrayLimit: 3, throwOnLimitExceeded: true });
1135
+ sst.ok(Array.isArray(result.a), 'result is an array');
1136
+ sst.deepEqual(result.a, ['1', '2', '3'], 'all values present');
1137
+ sst.end();
1138
+ });
1139
+
1117
1140
  st.test('converts array to object if length is greater than limit', function (sst) {
1118
1141
  var result = qs.parse('a[1]=1&a[2]=2&a[3]=3&a[4]=4&a[5]=5&a[6]=6', { arrayLimit: 5 });
1119
1142
 
@@ -1121,6 +1144,40 @@ test('parse()', function (t) {
1121
1144
  sst.end();
1122
1145
  });
1123
1146
 
1147
+ st.test('throws error when indexed notation exceeds arrayLimit with throwOnLimitExceeded', function (sst) {
1148
+ sst['throws'](
1149
+ function () {
1150
+ qs.parse('a[1001]=b', { arrayLimit: 1000, throwOnLimitExceeded: true });
1151
+ },
1152
+ new RangeError('Array limit exceeded. Only 1000 elements allowed in an array.'),
1153
+ 'throws error for a single index exceeding arrayLimit'
1154
+ );
1155
+
1156
+ sst['throws'](
1157
+ function () {
1158
+ qs.parse('a[0]=1&a[1]=2&a[2]=3&a[10]=4', { arrayLimit: 6, throwOnLimitExceeded: true, allowSparse: true });
1159
+ },
1160
+ new RangeError('Array limit exceeded. Only 6 elements allowed in an array.'),
1161
+ 'throws error when a sparse index exceeds arrayLimit'
1162
+ );
1163
+
1164
+ sst.end();
1165
+ });
1166
+
1167
+ st.test('does not throw for indexed notation within arrayLimit with throwOnLimitExceeded', function (sst) {
1168
+ var result = qs.parse('a[4]=b', { arrayLimit: 5, throwOnLimitExceeded: true, allowSparse: true });
1169
+ sst.ok(Array.isArray(result.a), 'result is an array');
1170
+ sst.equal(result.a.length, 5, 'array has correct length');
1171
+ sst.equal(result.a[4], 'b', 'value at index 4 is correct');
1172
+ sst.end();
1173
+ });
1174
+
1175
+ st.test('silently converts to object for indexed notation exceeding arrayLimit without throwOnLimitExceeded', function (sst) {
1176
+ var result = qs.parse('a[1001]=b', { arrayLimit: 1000 });
1177
+ sst.deepEqual(result, { a: { 1001: 'b' } }, 'converts to object without throwing');
1178
+ sst.end();
1179
+ });
1180
+
1124
1181
  st.end();
1125
1182
  });
1126
1183
 
@@ -1274,3 +1331,182 @@ test('qs strictDepth option - non-throw cases', function (t) {
1274
1331
  st.end();
1275
1332
  });
1276
1333
  });
1334
+
1335
+ test('DOS', function (t) {
1336
+ var arr = [];
1337
+ for (var i = 0; i < 105; i++) {
1338
+ arr[arr.length] = 'x';
1339
+ }
1340
+ var attack = 'a[]=' + arr.join('&a[]=');
1341
+ var result = qs.parse(attack, { arrayLimit: 100 });
1342
+
1343
+ t.notOk(Array.isArray(result.a), 'arrayLimit is respected: result is an object, not an array');
1344
+ t.equal(Object.keys(result.a).length, 105, 'all values are preserved');
1345
+
1346
+ t.end();
1347
+ });
1348
+
1349
+ test('arrayLimit boundary conditions', function (t) {
1350
+ // arrayLimit is the max number of elements allowed in an array
1351
+ t.test('exactly at the limit stays as array', function (st) {
1352
+ // 3 elements = limit of 3
1353
+ var result = qs.parse('a[]=1&a[]=2&a[]=3', { arrayLimit: 3 });
1354
+ st.ok(Array.isArray(result.a), 'result is an array when count equals limit');
1355
+ st.deepEqual(result.a, ['1', '2', '3'], 'all values present');
1356
+ st.end();
1357
+ });
1358
+
1359
+ t.test('one over the limit converts to object', function (st) {
1360
+ // 4 elements exceeds limit of 3
1361
+ var result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4', { arrayLimit: 3 });
1362
+ st.notOk(Array.isArray(result.a), 'result is not an array when over limit');
1363
+ st.deepEqual(result.a, { 0: '1', 1: '2', 2: '3', 3: '4' }, 'all values preserved as object');
1364
+ st.end();
1365
+ });
1366
+
1367
+ t.test('arrayLimit 1 with one value', function (st) {
1368
+ // 1 element = limit of 1
1369
+ var result = qs.parse('a[]=1', { arrayLimit: 1 });
1370
+ st.ok(Array.isArray(result.a), 'result is an array when count equals limit');
1371
+ st.deepEqual(result.a, ['1'], 'value preserved as array');
1372
+ st.end();
1373
+ });
1374
+
1375
+ t.test('arrayLimit 1 with two values converts to object', function (st) {
1376
+ // 2 elements exceeds limit of 1
1377
+ var result = qs.parse('a[]=1&a[]=2', { arrayLimit: 1 });
1378
+ st.notOk(Array.isArray(result.a), 'result is not an array');
1379
+ st.deepEqual(result.a, { 0: '1', 1: '2' }, 'all values preserved as object');
1380
+ st.end();
1381
+ });
1382
+
1383
+ t.end();
1384
+ });
1385
+
1386
+ test('comma + arrayLimit', function (t) {
1387
+ t.test('comma-separated values within arrayLimit stay as array', function (st) {
1388
+ var result = qs.parse('a=1,2,3', { comma: true, arrayLimit: 5 });
1389
+ st.ok(Array.isArray(result.a), 'result is an array');
1390
+ st.deepEqual(result.a, ['1', '2', '3'], 'all values present');
1391
+ st.end();
1392
+ });
1393
+
1394
+ t.test('comma-separated values exceeding arrayLimit convert to object', function (st) {
1395
+ var result = qs.parse('a=1,2,3,4', { comma: true, arrayLimit: 3 });
1396
+ st.notOk(Array.isArray(result.a), 'result is not an array when over limit');
1397
+ st.deepEqual(result.a, { 0: '1', 1: '2', 2: '3', 3: '4' }, 'all values preserved as object');
1398
+ st.end();
1399
+ });
1400
+
1401
+ t.test('comma-separated values exceeding arrayLimit with throwOnLimitExceeded throws', function (st) {
1402
+ st['throws'](
1403
+ function () {
1404
+ qs.parse('a=1,2,3,4', { comma: true, arrayLimit: 3, throwOnLimitExceeded: true });
1405
+ },
1406
+ new RangeError('Array limit exceeded. Only 3 elements allowed in an array.'),
1407
+ 'throws error when comma-split exceeds array limit'
1408
+ );
1409
+ st.end();
1410
+ });
1411
+
1412
+ t.test('comma-separated values at exactly arrayLimit stay as array', function (st) {
1413
+ var result = qs.parse('a=1,2,3', { comma: true, arrayLimit: 3 });
1414
+ st.ok(Array.isArray(result.a), 'result is an array when exactly at limit');
1415
+ st.deepEqual(result.a, ['1', '2', '3'], 'all values present');
1416
+ st.end();
1417
+ });
1418
+
1419
+ t.end();
1420
+ });
1421
+
1422
+ test('mixed array and object notation', function (t) {
1423
+ t.test('array brackets with object key - under limit', function (st) {
1424
+ st.deepEqual(
1425
+ qs.parse('a[]=b&a[c]=d'),
1426
+ { a: { 0: 'b', c: 'd' } },
1427
+ 'mixing [] and [key] converts to object'
1428
+ );
1429
+ st.end();
1430
+ });
1431
+
1432
+ t.test('array index with object key - under limit', function (st) {
1433
+ st.deepEqual(
1434
+ qs.parse('a[0]=b&a[c]=d'),
1435
+ { a: { 0: 'b', c: 'd' } },
1436
+ 'mixing [0] and [key] produces object'
1437
+ );
1438
+ st.end();
1439
+ });
1440
+
1441
+ t.test('plain value with array brackets - under limit', function (st) {
1442
+ st.deepEqual(
1443
+ qs.parse('a=b&a[]=c', { arrayLimit: 20 }),
1444
+ { a: ['b', 'c'] },
1445
+ 'plain value combined with [] stays as array under limit'
1446
+ );
1447
+ st.end();
1448
+ });
1449
+
1450
+ t.test('array brackets with plain value - under limit', function (st) {
1451
+ st.deepEqual(
1452
+ qs.parse('a[]=b&a=c', { arrayLimit: 20 }),
1453
+ { a: ['b', 'c'] },
1454
+ '[] combined with plain value stays as array under limit'
1455
+ );
1456
+ st.end();
1457
+ });
1458
+
1459
+ t.test('plain value with array index - under limit', function (st) {
1460
+ st.deepEqual(
1461
+ qs.parse('a=b&a[0]=c', { arrayLimit: 20 }),
1462
+ { a: ['b', 'c'] },
1463
+ 'plain value combined with [0] stays as array under limit'
1464
+ );
1465
+ st.end();
1466
+ });
1467
+
1468
+ t.test('multiple plain values with duplicates combine', function (st) {
1469
+ st.deepEqual(
1470
+ qs.parse('a=b&a=c&a=d', { arrayLimit: 20 }),
1471
+ { a: ['b', 'c', 'd'] },
1472
+ 'duplicate plain keys combine into array'
1473
+ );
1474
+ st.end();
1475
+ });
1476
+
1477
+ t.test('multiple plain values exceeding limit', function (st) {
1478
+ // 3 elements (indices 0-2), max index 2 > limit 1
1479
+ st.deepEqual(
1480
+ qs.parse('a=b&a=c&a=d', { arrayLimit: 1 }),
1481
+ { a: { 0: 'b', 1: 'c', 2: 'd' } },
1482
+ 'duplicate plain keys convert to object when exceeding limit'
1483
+ );
1484
+ st.end();
1485
+ });
1486
+
1487
+ t.test('mixed notation produces consistent results when arrayLimit is exceeded', function (st) {
1488
+ var expected = { a: { 0: 'b', 1: 'c', 2: 'd' } };
1489
+
1490
+ st.deepEqual(
1491
+ qs.parse('a[]=b&a[1]=c&a=d', { arrayLimit: -1 }),
1492
+ expected,
1493
+ 'arrayLimit -1'
1494
+ );
1495
+
1496
+ st.deepEqual(
1497
+ qs.parse('a[]=b&a[1]=c&a=d', { arrayLimit: 0 }),
1498
+ expected,
1499
+ 'arrayLimit 0'
1500
+ );
1501
+
1502
+ st.deepEqual(
1503
+ qs.parse('a[]=b&a[1]=c&a=d', { arrayLimit: 1 }),
1504
+ expected,
1505
+ 'arrayLimit 1'
1506
+ );
1507
+
1508
+ st.end();
1509
+ });
1510
+
1511
+ t.end();
1512
+ });
@@ -1293,13 +1293,17 @@ test('stringifies empty keys', function (t) {
1293
1293
  });
1294
1294
 
1295
1295
  t.test('stringifies non-string keys', function (st) {
1296
- var actual = qs.stringify({ a: 'b', 'false': {} }, {
1297
- filter: ['a', false, null],
1296
+ var S = Object('abc');
1297
+ S.toString = function () {
1298
+ return 'd';
1299
+ };
1300
+ var actual = qs.stringify({ a: 'b', 'false': {}, 1e+22: 'c', d: 'e' }, {
1301
+ filter: ['a', false, null, 10000000000000000000000, S],
1298
1302
  allowDots: true,
1299
1303
  encodeDotInKeys: true
1300
1304
  });
1301
1305
 
1302
- st.equal(actual, 'a=b', 'stringifies correctly');
1306
+ st.equal(actual, 'a=b&1e%2B22=c&d=e', 'stringifies correctly');
1303
1307
 
1304
1308
  st.end();
1305
1309
  });
@@ -68,6 +68,62 @@ test('merge()', function (t) {
68
68
  }
69
69
  );
70
70
 
71
+ t.test('with overflow objects (from arrayLimit)', function (st) {
72
+ // arrayLimit is max index, so with limit 0, max index 0 is allowed (1 element)
73
+ // To create overflow, need 2+ elements with limit 0, or 3+ with limit 1, etc.
74
+ st.test('merges primitive into overflow object at next index', function (s2t) {
75
+ // Create an overflow object via combine: 3 elements (indices 0-2) with limit 0
76
+ var overflow = utils.combine(['a', 'b'], 'c', 0, false);
77
+ s2t.ok(utils.isOverflow(overflow), 'overflow object is marked');
78
+ var merged = utils.merge(overflow, 'd');
79
+ s2t.deepEqual(merged, { 0: 'a', 1: 'b', 2: 'c', 3: 'd' }, 'adds primitive at next numeric index');
80
+ s2t.end();
81
+ });
82
+
83
+ st.test('merges primitive into regular object with numeric keys normally', function (s2t) {
84
+ var obj = { 0: 'a', 1: 'b' };
85
+ s2t.notOk(utils.isOverflow(obj), 'plain object is not marked as overflow');
86
+ var merged = utils.merge(obj, 'c');
87
+ s2t.deepEqual(merged, { 0: 'a', 1: 'b', c: true }, 'adds primitive as key (not at next index)');
88
+ s2t.end();
89
+ });
90
+
91
+ st.test('merges primitive into object with non-numeric keys normally', function (s2t) {
92
+ var obj = { foo: 'bar' };
93
+ var merged = utils.merge(obj, 'baz');
94
+ s2t.deepEqual(merged, { foo: 'bar', baz: true }, 'adds primitive as key with value true');
95
+ s2t.end();
96
+ });
97
+
98
+ st.test('merges overflow object into primitive', function (s2t) {
99
+ // Create an overflow object via combine: 2 elements (indices 0-1) with limit 0
100
+ var overflow = utils.combine(['a'], 'b', 0, false);
101
+ s2t.ok(utils.isOverflow(overflow), 'overflow object is marked');
102
+ var merged = utils.merge('c', overflow);
103
+ s2t.ok(utils.isOverflow(merged), 'result is also marked as overflow');
104
+ s2t.deepEqual(merged, { 0: 'c', 1: 'a', 2: 'b' }, 'creates object with primitive at 0, source values shifted');
105
+ s2t.end();
106
+ });
107
+
108
+ st.test('merges overflow object with multiple values into primitive', function (s2t) {
109
+ // Create an overflow object via combine: 3 elements (indices 0-2) with limit 0
110
+ var overflow = utils.combine(['b', 'c'], 'd', 0, false);
111
+ s2t.ok(utils.isOverflow(overflow), 'overflow object is marked');
112
+ var merged = utils.merge('a', overflow);
113
+ s2t.deepEqual(merged, { 0: 'a', 1: 'b', 2: 'c', 3: 'd' }, 'shifts all source indices by 1');
114
+ s2t.end();
115
+ });
116
+
117
+ st.test('merges regular object into primitive as array', function (s2t) {
118
+ var obj = { foo: 'bar' };
119
+ var merged = utils.merge('a', obj);
120
+ s2t.deepEqual(merged, ['a', { foo: 'bar' }], 'creates array with primitive and object');
121
+ s2t.end();
122
+ });
123
+
124
+ st.end();
125
+ });
126
+
71
127
  t.end();
72
128
  });
73
129
 
@@ -132,6 +188,85 @@ test('combine()', function (t) {
132
188
  st.end();
133
189
  });
134
190
 
191
+ t.test('with arrayLimit', function (st) {
192
+ st.test('under the limit', function (s2t) {
193
+ var combined = utils.combine(['a', 'b'], 'c', 10, false);
194
+ s2t.deepEqual(combined, ['a', 'b', 'c'], 'returns array when under limit');
195
+ s2t.ok(Array.isArray(combined), 'result is an array');
196
+ s2t.end();
197
+ });
198
+
199
+ st.test('exactly at the limit stays as array', function (s2t) {
200
+ var combined = utils.combine(['a', 'b'], 'c', 3, false);
201
+ s2t.deepEqual(combined, ['a', 'b', 'c'], 'stays as array when count equals limit');
202
+ s2t.ok(Array.isArray(combined), 'result is an array');
203
+ s2t.end();
204
+ });
205
+
206
+ st.test('over the limit', function (s2t) {
207
+ var combined = utils.combine(['a', 'b', 'c'], 'd', 3, false);
208
+ s2t.deepEqual(combined, { 0: 'a', 1: 'b', 2: 'c', 3: 'd' }, 'converts to object when over limit');
209
+ s2t.notOk(Array.isArray(combined), 'result is not an array');
210
+ s2t.end();
211
+ });
212
+
213
+ st.test('with arrayLimit 1', function (s2t) {
214
+ var combined = utils.combine([], 'a', 1, false);
215
+ s2t.deepEqual(combined, ['a'], 'stays as array when count equals limit');
216
+ s2t.ok(Array.isArray(combined), 'result is an array');
217
+ s2t.end();
218
+ });
219
+
220
+ st.test('with arrayLimit 0 converts single element to object', function (s2t) {
221
+ var combined = utils.combine([], 'a', 0, false);
222
+ s2t.deepEqual(combined, { 0: 'a' }, 'converts to object when count exceeds limit');
223
+ s2t.notOk(Array.isArray(combined), 'result is not an array');
224
+ s2t.end();
225
+ });
226
+
227
+ st.test('with arrayLimit 0 and two elements converts to object', function (s2t) {
228
+ var combined = utils.combine(['a'], 'b', 0, false);
229
+ s2t.deepEqual(combined, { 0: 'a', 1: 'b' }, 'converts to object when count exceeds limit');
230
+ s2t.notOk(Array.isArray(combined), 'result is not an array');
231
+ s2t.end();
232
+ });
233
+
234
+ st.test('with plainObjects option', function (s2t) {
235
+ var combined = utils.combine(['a', 'b'], 'c', 1, true);
236
+ var expected = { __proto__: null, 0: 'a', 1: 'b', 2: 'c' };
237
+ s2t.deepEqual(combined, expected, 'converts to object with null prototype');
238
+ s2t.equal(Object.getPrototypeOf(combined), null, 'result has null prototype when plainObjects is true');
239
+ s2t.end();
240
+ });
241
+
242
+ st.end();
243
+ });
244
+
245
+ t.test('with existing overflow object', function (st) {
246
+ st.test('adds to existing overflow object at next index', function (s2t) {
247
+ // Create overflow object first via combine: 3 elements (indices 0-2) with limit 0
248
+ var overflow = utils.combine(['a', 'b'], 'c', 0, false);
249
+ s2t.ok(utils.isOverflow(overflow), 'initial object is marked as overflow');
250
+
251
+ var combined = utils.combine(overflow, 'd', 10, false);
252
+ s2t.equal(combined, overflow, 'returns the same object (mutated)');
253
+ s2t.deepEqual(combined, { 0: 'a', 1: 'b', 2: 'c', 3: 'd' }, 'adds value at next numeric index');
254
+ s2t.end();
255
+ });
256
+
257
+ st.test('does not treat plain object with numeric keys as overflow', function (s2t) {
258
+ var plainObj = { 0: 'a', 1: 'b' };
259
+ s2t.notOk(utils.isOverflow(plainObj), 'plain object is not marked as overflow');
260
+
261
+ // combine treats this as a regular value, not an overflow object to append to
262
+ var combined = utils.combine(plainObj, 'c', 10, false);
263
+ s2t.deepEqual(combined, [{ 0: 'a', 1: 'b' }, 'c'], 'concatenates as regular values');
264
+ s2t.end();
265
+ });
266
+
267
+ st.end();
268
+ });
269
+
135
270
  t.end();
136
271
  });
137
272
 
@@ -1,3 +1,15 @@
1
+ ## **6.5.5**
2
+ - [Fix] fix regressions from robustness refactor
3
+ - [meta] add `npmignore` to autogenerate an npmignore file
4
+ - [actions] update reusable workflows
5
+
6
+ ## **6.5.4**
7
+ - [Robustness] avoid `.push`, use `void`
8
+ - [readme] clarify `parseArrays` and `arrayLimit` documentation (#543)
9
+ - [readme] document that `addQueryPrefix` does not add `?` to empty output (#418)
10
+ - [readme] replace runkit CI badge with shields.io check-runs badge
11
+ - [actions] fix rebase workflow permissions
12
+
1
13
  ## **6.5.3**
2
14
  - [Fix] `parse`: ignore `__proto__` keys (#428)
3
15
  - [Fix]` `utils.merge`: avoid a crash with a null target and a truthy non-array source
@@ -182,7 +182,7 @@ var withIndexedEmptyString = qs.parse('a[0]=b&a[1]=&a[2]=c');
182
182
  assert.deepEqual(withIndexedEmptyString, { a: ['b', '', 'c'] });
183
183
  ```
184
184
 
185
- **qs** will also limit specifying indices in an array to a maximum index of `20`. Any array members with an index of greater than `20` will
185
+ **qs** will also limit arrays to a maximum of `20` elements. Any array members with an index of `20` or greater will
186
186
  instead be converted to an object with the index as the key. This is needed to handle cases when someone sent, for example, `a[999999999]` and it will take significant time to iterate over this huge array.
187
187
 
188
188
  ```javascript
@@ -197,7 +197,7 @@ var withArrayLimit = qs.parse('a[1]=b', { arrayLimit: 0 });
197
197
  assert.deepEqual(withArrayLimit, { a: { '1': 'b' } });
198
198
  ```
199
199
 
200
- To disable array parsing entirely, set `parseArrays` to `false`.
200
+ To prevent array syntax (`a[]`, `a[0]`) from being parsed as arrays, set `parseArrays` to `false`.
201
201
 
202
202
  ```javascript
203
203
  var noParsingArrays = qs.parse('a[]=b', { parseArrays: false });
@@ -361,6 +361,12 @@ The query string may optionally be prepended with a question mark:
361
361
  assert.equal(qs.stringify({ a: 'b', c: 'd' }, { addQueryPrefix: true }), '?a=b&c=d');
362
362
  ```
363
363
 
364
+ Note that when the output is an empty string, the prefix will not be added:
365
+
366
+ ```javascript
367
+ assert.equal(qs.stringify({}, { addQueryPrefix: true }), '');
368
+ ```
369
+
364
370
  The delimiter may be overridden with stringify as well:
365
371
 
366
372
  ```javascript
@@ -506,5 +512,5 @@ The maintainers of qs and thousands of other packages are working with Tidelift
506
512
  [downloads-url]: https://npm-stat.com/charts.html?package=qs
507
513
  [codecov-image]: https://codecov.io/gh/ljharb/qs/branch/main/graphs/badge.svg
508
514
  [codecov-url]: https://app.codecov.io/gh/ljharb/qs/
509
- [actions-image]: https://img.shields.io/endpoint?url=https://github-actions-badge-u3jn4tfpocch.runkit.sh/ljharb/qs
515
+ [actions-image]: https://img.shields.io/github/check-runs/ljharb/qs/main
510
516
  [actions-url]: https://github.com/ljharb/qs/actions
@@ -53,7 +53,7 @@ var defaults = {
53
53
  var parseValues = function parseQueryStringValues(str, options) {
54
54
  var obj = {};
55
55
  var cleanStr = options.ignoreQueryPrefix ? str.replace(/^\?/, '') : str;
56
- var limit = options.parameterLimit === Infinity ? undefined : options.parameterLimit;
56
+ var limit = options.parameterLimit === Infinity ? void undefined : options.parameterLimit;
57
57
  var parts = cleanStr.split(options.delimiter, limit);
58
58
 
59
59
  for (var i = 0; i < parts.length; ++i) {
@@ -145,7 +145,7 @@ var parseKeys = function parseQueryStringKeys(givenKey, val, options) {
145
145
  }
146
146
  }
147
147
 
148
- keys.push(parent);
148
+ keys[keys.length] = parent;
149
149
  }
150
150
 
151
151
  // Loop through children appending to the array until we hit depth
@@ -158,13 +158,13 @@ var parseKeys = function parseQueryStringKeys(givenKey, val, options) {
158
158
  return;
159
159
  }
160
160
  }
161
- keys.push(segment[1]);
161
+ keys[keys.length] = segment[1];
162
162
  }
163
163
 
164
164
  // If there's a remainder, just add whatever is left
165
165
 
166
166
  if (segment) {
167
- keys.push('[' + key.slice(segment.index) + ']');
167
+ keys[keys.length] = '[' + key.slice(segment.index) + ']';
168
168
  }
169
169
 
170
170
  return parseObject(keys, val, options);
@@ -435,7 +435,7 @@ var has = Object.prototype.hasOwnProperty;
435
435
  var hexTable = (function () {
436
436
  var array = [];
437
437
  for (var i = 0; i < 256; ++i) {
438
- array.push('%' + ((i < 16 ? '0' : '') + i.toString(16)).toUpperCase());
438
+ array[array.length] = '%' + ((i < 16 ? '0' : '') + i.toString(16)).toUpperCase();
439
439
  }
440
440
 
441
441
  return array;
@@ -453,7 +453,7 @@ var compactQueue = function compactQueue(queue) {
453
453
 
454
454
  for (var j = 0; j < obj.length; ++j) {
455
455
  if (typeof obj[j] !== 'undefined') {
456
- compacted.push(obj[j]);
456
+ compacted[compacted.length] = obj[j];
457
457
  }
458
458
  }
459
459
 
@@ -482,7 +482,7 @@ var merge = function merge(target, source, options) {
482
482
 
483
483
  if (typeof source !== 'object') {
484
484
  if (Array.isArray(target)) {
485
- target.push(source);
485
+ target[target.length] = source;
486
486
  } else if (target && typeof target === 'object') {
487
487
  if ((options && (options.plainObjects || options.allowPrototypes)) || !has.call(Object.prototype, source)) {
488
488
  target[source] = true;
@@ -510,7 +510,7 @@ var merge = function merge(target, source, options) {
510
510
  if (targetItem && typeof targetItem === 'object' && item && typeof item === 'object') {
511
511
  target[i] = merge(targetItem, item, options);
512
512
  } else {
513
- target.push(item);
513
+ target[target.length] = item;
514
514
  }
515
515
  } else {
516
516
  target[i] = item;
@@ -612,8 +612,8 @@ var compact = function compact(value) {
612
612
  var key = keys[j];
613
613
  var val = obj[key];
614
614
  if (typeof val === 'object' && val !== null && refs.indexOf(val) === -1) {
615
- queue.push({ obj: obj, prop: key });
616
- refs.push(val);
615
+ queue[queue.length] = { obj: obj, prop: key };
616
+ refs[refs.length] = val;
617
617
  }
618
618
  }
619
619
  }
@@ -19,7 +19,7 @@ var defaults = {
19
19
  var parseValues = function parseQueryStringValues(str, options) {
20
20
  var obj = {};
21
21
  var cleanStr = options.ignoreQueryPrefix ? str.replace(/^\?/, '') : str;
22
- var limit = options.parameterLimit === Infinity ? undefined : options.parameterLimit;
22
+ var limit = options.parameterLimit === Infinity ? void undefined : options.parameterLimit;
23
23
  var parts = cleanStr.split(options.delimiter, limit);
24
24
 
25
25
  for (var i = 0; i < parts.length; ++i) {
@@ -111,7 +111,7 @@ var parseKeys = function parseQueryStringKeys(givenKey, val, options) {
111
111
  }
112
112
  }
113
113
 
114
- keys.push(parent);
114
+ keys[keys.length] = parent;
115
115
  }
116
116
 
117
117
  // Loop through children appending to the array until we hit depth
@@ -124,13 +124,13 @@ var parseKeys = function parseQueryStringKeys(givenKey, val, options) {
124
124
  return;
125
125
  }
126
126
  }
127
- keys.push(segment[1]);
127
+ keys[keys.length] = segment[1];
128
128
  }
129
129
 
130
130
  // If there's a remainder, just add whatever is left
131
131
 
132
132
  if (segment) {
133
- keys.push('[' + key.slice(segment.index) + ']');
133
+ keys[keys.length] = '[' + key.slice(segment.index) + ']';
134
134
  }
135
135
 
136
136
  return parseObject(keys, val, options);