v6.5.3

CHANGELOG.md

@@ -1,3 +1,27 @@
+## **6.5.3**
+- [Fix] `parse`: ignore `__proto__` keys (#428)
+- [Fix]` `utils.merge`: avoid a crash with a null target and a truthy non-array source
+- [Fix] correctly parse nested arrays
+- [Fix] `stringify`: fix a crash with `strictNullHandling` and a custom `filter`/`serializeDate` (#279)
+- [Fix] `utils`: `merge`: fix crash when `source` is a truthy primitive & no options are provided
+- [Fix] when `parseArrays` is false, properly handle keys ending in `[]`
+- [Fix] fix for an impossible situation: when the formatter is called with a non-string value
+- [Fix] `utils.merge`: avoid a crash with a null target and an array source
+- [Refactor] `utils`: reduce observable [[Get]]s
+- [Refactor] use cached `Array.isArray`
+- [Refactor] `stringify`: Avoid arr = arr.concat(...), push to the existing instance (#269)
+- [Refactor] `parse`: only need to reassign the var once
+- [Robustness] `stringify`: avoid relying on a global `undefined` (#427)
+- [readme] remove travis badge; add github actions/codecov badges; update URLs
+- [Docs] Clean up license text so it’s properly detected as BSD-3-Clause
+- [Docs] Clarify the need for "arrayLimit" option
+- [meta] fix README.md (#399)
+- [meta] add FUNDING.yml
+- [actions] backport actions from main
+- [Tests] always use `String(x)` over `x.toString()`
+- [Tests] remove nonexistent tape option
+- [Dev Deps] backport from main
+
 ## **6.5.2**
 - [Fix] use `safer-buffer` instead of `Buffer` constructor
 - [Refactor] utils: `module.exports` one thing, instead of mutating `exports` (#230)

component.json

@@ -1,8 +1,8 @@
 {
  "name": "qs",
- "repository": "hapijs/qs",
+ "repository": "ljharb/qs",
  "description": "query-string parser / stringifier with nesting support",
- "version": "6.5.0",
+ "version": "6.5.3",
  "keywords": ["querystring", "query", "parser"],
  "main": "lib/index.js",
  "scripts": [

dist/qs.js

@@ -11,7 +11,7 @@ module.exports = {
  return replace.call(value, percentTwenties, '+');
  },
  RFC3986: function (value) {
- return value;
+ return String(value);
  }
  },
  RFC1738: 'RFC1738',
@@ -87,14 +87,15 @@ var parseObject = function (chain, val, options) {
  var obj;
  var root = chain[i];
 
- if (root === '[]') {
- obj = [];
- obj = obj.concat(leaf);
+ if (root === '[]' && options.parseArrays) {
+ obj = [].concat(leaf);
  } else {
  obj = options.plainObjects ? Object.create(null) : {};
  var cleanRoot = root.charAt(0) === '[' && root.charAt(root.length - 1) === ']' ? root.slice(1, -1) : root;
  var index = parseInt(cleanRoot, 10);
- if (
+ if (!options.parseArrays && cleanRoot === '') {
+ obj = { 0: leaf };
+ } else if (
  !isNaN(index)
  && root !== cleanRoot
  && String(index) === cleanRoot
@@ -103,7 +104,7 @@ var parseObject = function (chain, val, options) {
  ) {
  obj = [];
  obj[index] = leaf;
- } else {
+ } else if (cleanRoot !== '__proto__') {
  obj[cleanRoot] = leaf;
  }
  }
@@ -214,32 +215,38 @@ var utils = require('./utils');
 var formats = require('./formats');
 
 var arrayPrefixGenerators = {
- brackets: function brackets(prefix) { // eslint-disable-line func-name-matching
+ brackets: function brackets(prefix) {
  return prefix + '[]';
  },
- indices: function indices(prefix, key) { // eslint-disable-line func-name-matching
+ indices: function indices(prefix, key) {
  return prefix + '[' + key + ']';
  },
- repeat: function repeat(prefix) { // eslint-disable-line func-name-matching
+ repeat: function repeat(prefix) {
  return prefix;
  }
 };
 
+var isArray = Array.isArray;
+var push = Array.prototype.push;
+var pushToArray = function (arr, valueOrArray) {
+ push.apply(arr, isArray(valueOrArray) ? valueOrArray : [valueOrArray]);
+};
+
 var toISO = Date.prototype.toISOString;
 
 var defaults = {
  delimiter: '&',
  encode: true,
  encoder: utils.encode,
  encodeValuesOnly: false,
- serializeDate: function serializeDate(date) { // eslint-disable-line func-name-matching
+ serializeDate: function serializeDate(date) {
  return toISO.call(date);
  },
  skipNulls: false,
  strictNullHandling: false
 };
 
-var stringify = function stringify( // eslint-disable-line func-name-matching
+var stringify = function stringify(
  object,
  prefix,
  generateArrayPrefix,
@@ -258,7 +265,9 @@ var stringify = function stringify( // eslint-disable-line func-name-matching
  obj = filter(prefix, obj);
  } else if (obj instanceof Date) {
  obj = serializeDate(obj);
- } else if (obj === null) {
+ }
+
+ if (obj === null) {
  if (strictNullHandling) {
  return encoder && !encodeValuesOnly ? encoder(prefix, defaults.encoder) : prefix;
  }
@@ -281,7 +290,7 @@ var stringify = function stringify( // eslint-disable-line func-name-matching
  }
 
  var objKeys;
- if (Array.isArray(filter)) {
+ if (isArray(filter)) {
  objKeys = filter;
  } else {
  var keys = Object.keys(obj);
@@ -295,8 +304,8 @@ var stringify = function stringify( // eslint-disable-line func-name-matching
  continue;
  }
 
- if (Array.isArray(obj)) {
- values = values.concat(stringify(
+ if (isArray(obj)) {
+ pushToArray(values, stringify(
  obj[key],
  generateArrayPrefix(prefix, key),
  generateArrayPrefix,
@@ -311,7 +320,7 @@ var stringify = function stringify( // eslint-disable-line func-name-matching
  encodeValuesOnly
  ));
  } else {
- values = values.concat(stringify(
+ pushToArray(values, stringify(
  obj[key],
  prefix + (allowDots ? '.' + key : '[' + key + ']'),
  generateArrayPrefix,
@@ -335,7 +344,7 @@ module.exports = function (object, opts) {
  var obj = object;
  var options = opts ? utils.assign({}, opts) : {};
 
- if (options.encoder !== null && options.encoder !== undefined && typeof options.encoder !== 'function') {
+ if (options.encoder !== null && typeof options.encoder !== 'undefined' && typeof options.encoder !== 'function') {
  throw new TypeError('Encoder has to be a function.');
  }
 
@@ -360,7 +369,7 @@ module.exports = function (object, opts) {
  if (typeof options.filter === 'function') {
  filter = options.filter;
  obj = filter('', obj);
- } else if (Array.isArray(options.filter)) {
+ } else if (isArray(options.filter)) {
  filter = options.filter;
  objKeys = filter;
  }
@@ -396,8 +405,7 @@ module.exports = function (object, opts) {
  if (skipNulls && obj[key] === null) {
  continue;
  }
-
- keys = keys.concat(stringify(
+ pushToArray(keys, stringify(
  obj[key],
  key,
  generateArrayPrefix,
@@ -475,8 +483,8 @@ var merge = function merge(target, source, options) {
  if (typeof source !== 'object') {
  if (Array.isArray(target)) {
  target.push(source);
- } else if (typeof target === 'object') {
- if (options.plainObjects || options.allowPrototypes || !has.call(Object.prototype, source)) {
+ } else if (target && typeof target === 'object') {
+ if ((options && (options.plainObjects || options.allowPrototypes)) || !has.call(Object.prototype, source)) {
  target[source] = true;
  }
  } else {
@@ -486,7 +494,7 @@ var merge = function merge(target, source, options) {
  return target;
  }
 
- if (typeof target !== 'object') {
+ if (!target || typeof target !== 'object') {
  return [target].concat(source);
  }
 
@@ -498,8 +506,9 @@ var merge = function merge(target, source, options) {
  if (Array.isArray(target) && Array.isArray(source)) {
  source.forEach(function (item, i) {
  if (has.call(target, i)) {
- if (target[i] && typeof target[i] === 'object') {
- target[i] = merge(target[i], item, options);
+ var targetItem = target[i];
+ if (targetItem && typeof targetItem === 'object' && item && typeof item === 'object') {
+ target[i] = merge(targetItem, item, options);
  } else {
  target.push(item);
  }
@@ -580,6 +589,7 @@ var encode = function encode(str) {
 
  i += 1;
  c = 0x10000 + (((c & 0x3FF) << 10) | (string.charCodeAt(i) & 0x3FF));
+ /* eslint operator-linebreak: [2, "before"] */
  out += hexTable[0xF0 | (c >> 18)]
  + hexTable[0x80 | ((c >> 12) & 0x3F)]
  + hexTable[0x80 | ((c >> 6) & 0x3F)]

package.json

@@ -2,7 +2,7 @@
  "name": "qs",
  "description": "A querystring parser that supports nesting and arrays, with a depth limit",
  "homepage": "https://github.com/ljharb/qs",
- "version": "6.5.2",
+ "version": "6.5.3",
  "repository": {
  "type": "git",
  "url": "https://github.com/ljharb/qs.git"