parse.js 23 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587
  1. 'use strict';
  2. var test = require('tape');
  3. var qs = require('../');
  4. var iconv = require('iconv-lite');
  5. var SaferBuffer = require('safer-buffer').Buffer;
  6. test('parse()', function (t) {
  7. t.test('parses a simple string', function (st) {
  8. st.deepEqual(qs.parse('0=foo'), { 0: 'foo' });
  9. st.deepEqual(qs.parse('foo=c++'), { foo: 'c ' });
  10. st.deepEqual(qs.parse('a[>=]=23'), { a: { '>=': '23' } });
  11. st.deepEqual(qs.parse('a[<=>]==23'), { a: { '<=>': '=23' } });
  12. st.deepEqual(qs.parse('a[==]=23'), { a: { '==': '23' } });
  13. st.deepEqual(qs.parse('foo', { strictNullHandling: true }), { foo: null });
  14. st.deepEqual(qs.parse('foo'), { foo: '' });
  15. st.deepEqual(qs.parse('foo='), { foo: '' });
  16. st.deepEqual(qs.parse('foo=bar'), { foo: 'bar' });
  17. st.deepEqual(qs.parse(' foo = bar = baz '), { ' foo ': ' bar = baz ' });
  18. st.deepEqual(qs.parse('foo=bar=baz'), { foo: 'bar=baz' });
  19. st.deepEqual(qs.parse('foo=bar&bar=baz'), { foo: 'bar', bar: 'baz' });
  20. st.deepEqual(qs.parse('foo2=bar2&baz2='), { foo2: 'bar2', baz2: '' });
  21. st.deepEqual(qs.parse('foo=bar&baz', { strictNullHandling: true }), { foo: 'bar', baz: null });
  22. st.deepEqual(qs.parse('foo=bar&baz'), { foo: 'bar', baz: '' });
  23. st.deepEqual(qs.parse('cht=p3&chd=t:60,40&chs=250x100&chl=Hello|World'), {
  24. cht: 'p3',
  25. chd: 't:60,40',
  26. chs: '250x100',
  27. chl: 'Hello|World'
  28. });
  29. st.end();
  30. });
  31. t.test('allows enabling dot notation', function (st) {
  32. st.deepEqual(qs.parse('a.b=c'), { 'a.b': 'c' });
  33. st.deepEqual(qs.parse('a.b=c', { allowDots: true }), { a: { b: 'c' } });
  34. st.end();
  35. });
  36. t.deepEqual(qs.parse('a[b]=c'), { a: { b: 'c' } }, 'parses a single nested string');
  37. t.deepEqual(qs.parse('a[b][c]=d'), { a: { b: { c: 'd' } } }, 'parses a double nested string');
  38. t.deepEqual(
  39. qs.parse('a[b][c][d][e][f][g][h]=i'),
  40. { a: { b: { c: { d: { e: { f: { '[g][h]': 'i' } } } } } } },
  41. 'defaults to a depth of 5'
  42. );
  43. t.test('only parses one level when depth = 1', function (st) {
  44. st.deepEqual(qs.parse('a[b][c]=d', { depth: 1 }), { a: { b: { '[c]': 'd' } } });
  45. st.deepEqual(qs.parse('a[b][c][d]=e', { depth: 1 }), { a: { b: { '[c][d]': 'e' } } });
  46. st.end();
  47. });
  48. t.deepEqual(qs.parse('a=b&a=c'), { a: ['b', 'c'] }, 'parses a simple array');
  49. t.test('parses an explicit array', function (st) {
  50. st.deepEqual(qs.parse('a[]=b'), { a: ['b'] });
  51. st.deepEqual(qs.parse('a[]=b&a[]=c'), { a: ['b', 'c'] });
  52. st.deepEqual(qs.parse('a[]=b&a[]=c&a[]=d'), { a: ['b', 'c', 'd'] });
  53. st.end();
  54. });
  55. t.test('parses a mix of simple and explicit arrays', function (st) {
  56. st.deepEqual(qs.parse('a=b&a[]=c'), { a: ['b', 'c'] });
  57. st.deepEqual(qs.parse('a[]=b&a=c'), { a: ['b', 'c'] });
  58. st.deepEqual(qs.parse('a[0]=b&a=c'), { a: ['b', 'c'] });
  59. st.deepEqual(qs.parse('a=b&a[0]=c'), { a: ['b', 'c'] });
  60. st.deepEqual(qs.parse('a[1]=b&a=c', { arrayLimit: 20 }), { a: ['b', 'c'] });
  61. st.deepEqual(qs.parse('a[]=b&a=c', { arrayLimit: 0 }), { a: ['b', 'c'] });
  62. st.deepEqual(qs.parse('a[]=b&a=c'), { a: ['b', 'c'] });
  63. st.deepEqual(qs.parse('a=b&a[1]=c', { arrayLimit: 20 }), { a: ['b', 'c'] });
  64. st.deepEqual(qs.parse('a=b&a[]=c', { arrayLimit: 0 }), { a: ['b', 'c'] });
  65. st.deepEqual(qs.parse('a=b&a[]=c'), { a: ['b', 'c'] });
  66. st.end();
  67. });
  68. t.test('parses a nested array', function (st) {
  69. st.deepEqual(qs.parse('a[b][]=c&a[b][]=d'), { a: { b: ['c', 'd'] } });
  70. st.deepEqual(qs.parse('a[>=]=25'), { a: { '>=': '25' } });
  71. st.end();
  72. });
  73. t.test('allows to specify array indices', function (st) {
  74. st.deepEqual(qs.parse('a[1]=c&a[0]=b&a[2]=d'), { a: ['b', 'c', 'd'] });
  75. st.deepEqual(qs.parse('a[1]=c&a[0]=b'), { a: ['b', 'c'] });
  76. st.deepEqual(qs.parse('a[1]=c', { arrayLimit: 20 }), { a: ['c'] });
  77. st.deepEqual(qs.parse('a[1]=c', { arrayLimit: 0 }), { a: { 1: 'c' } });
  78. st.deepEqual(qs.parse('a[1]=c'), { a: ['c'] });
  79. st.end();
  80. });
  81. t.test('limits specific array indices to arrayLimit', function (st) {
  82. st.deepEqual(qs.parse('a[20]=a', { arrayLimit: 20 }), { a: ['a'] });
  83. st.deepEqual(qs.parse('a[21]=a', { arrayLimit: 20 }), { a: { 21: 'a' } });
  84. st.end();
  85. });
  86. t.deepEqual(qs.parse('a[12b]=c'), { a: { '12b': 'c' } }, 'supports keys that begin with a number');
  87. t.test('supports encoded = signs', function (st) {
  88. st.deepEqual(qs.parse('he%3Dllo=th%3Dere'), { 'he=llo': 'th=ere' });
  89. st.end();
  90. });
  91. t.test('is ok with url encoded strings', function (st) {
  92. st.deepEqual(qs.parse('a[b%20c]=d'), { a: { 'b c': 'd' } });
  93. st.deepEqual(qs.parse('a[b]=c%20d'), { a: { b: 'c d' } });
  94. st.end();
  95. });
  96. t.test('allows brackets in the value', function (st) {
  97. st.deepEqual(qs.parse('pets=["tobi"]'), { pets: '["tobi"]' });
  98. st.deepEqual(qs.parse('operators=[">=", "<="]'), { operators: '[">=", "<="]' });
  99. st.end();
  100. });
  101. t.test('allows empty values', function (st) {
  102. st.deepEqual(qs.parse(''), {});
  103. st.deepEqual(qs.parse(null), {});
  104. st.deepEqual(qs.parse(undefined), {});
  105. st.end();
  106. });
  107. t.test('transforms arrays to objects', function (st) {
  108. st.deepEqual(qs.parse('foo[0]=bar&foo[bad]=baz'), { foo: { 0: 'bar', bad: 'baz' } });
  109. st.deepEqual(qs.parse('foo[bad]=baz&foo[0]=bar'), { foo: { bad: 'baz', 0: 'bar' } });
  110. st.deepEqual(qs.parse('foo[bad]=baz&foo[]=bar'), { foo: { bad: 'baz', 0: 'bar' } });
  111. st.deepEqual(qs.parse('foo[]=bar&foo[bad]=baz'), { foo: { 0: 'bar', bad: 'baz' } });
  112. st.deepEqual(qs.parse('foo[bad]=baz&foo[]=bar&foo[]=foo'), { foo: { bad: 'baz', 0: 'bar', 1: 'foo' } });
  113. st.deepEqual(qs.parse('foo[0][a]=a&foo[0][b]=b&foo[1][a]=aa&foo[1][b]=bb'), { foo: [{ a: 'a', b: 'b' }, { a: 'aa', b: 'bb' }] });
  114. st.deepEqual(qs.parse('a[]=b&a[t]=u&a[hasOwnProperty]=c', { allowPrototypes: false }), { a: { 0: 'b', t: 'u' } });
  115. st.deepEqual(qs.parse('a[]=b&a[t]=u&a[hasOwnProperty]=c', { allowPrototypes: true }), { a: { 0: 'b', t: 'u', hasOwnProperty: 'c' } });
  116. st.deepEqual(qs.parse('a[]=b&a[hasOwnProperty]=c&a[x]=y', { allowPrototypes: false }), { a: { 0: 'b', x: 'y' } });
  117. st.deepEqual(qs.parse('a[]=b&a[hasOwnProperty]=c&a[x]=y', { allowPrototypes: true }), { a: { 0: 'b', hasOwnProperty: 'c', x: 'y' } });
  118. st.end();
  119. });
  120. t.test('transforms arrays to objects (dot notation)', function (st) {
  121. st.deepEqual(qs.parse('foo[0].baz=bar&fool.bad=baz', { allowDots: true }), { foo: [{ baz: 'bar' }], fool: { bad: 'baz' } });
  122. st.deepEqual(qs.parse('foo[0].baz=bar&fool.bad.boo=baz', { allowDots: true }), { foo: [{ baz: 'bar' }], fool: { bad: { boo: 'baz' } } });
  123. st.deepEqual(qs.parse('foo[0][0].baz=bar&fool.bad=baz', { allowDots: true }), { foo: [[{ baz: 'bar' }]], fool: { bad: 'baz' } });
  124. st.deepEqual(qs.parse('foo[0].baz[0]=15&foo[0].bar=2', { allowDots: true }), { foo: [{ baz: ['15'], bar: '2' }] });
  125. st.deepEqual(qs.parse('foo[0].baz[0]=15&foo[0].baz[1]=16&foo[0].bar=2', { allowDots: true }), { foo: [{ baz: ['15', '16'], bar: '2' }] });
  126. st.deepEqual(qs.parse('foo.bad=baz&foo[0]=bar', { allowDots: true }), { foo: { bad: 'baz', 0: 'bar' } });
  127. st.deepEqual(qs.parse('foo.bad=baz&foo[]=bar', { allowDots: true }), { foo: { bad: 'baz', 0: 'bar' } });
  128. st.deepEqual(qs.parse('foo[]=bar&foo.bad=baz', { allowDots: true }), { foo: { 0: 'bar', bad: 'baz' } });
  129. st.deepEqual(qs.parse('foo.bad=baz&foo[]=bar&foo[]=foo', { allowDots: true }), { foo: { bad: 'baz', 0: 'bar', 1: 'foo' } });
  130. st.deepEqual(qs.parse('foo[0].a=a&foo[0].b=b&foo[1].a=aa&foo[1].b=bb', { allowDots: true }), { foo: [{ a: 'a', b: 'b' }, { a: 'aa', b: 'bb' }] });
  131. st.end();
  132. });
  133. t.test('correctly prunes undefined values when converting an array to an object', function (st) {
  134. st.deepEqual(qs.parse('a[2]=b&a[99999999]=c'), { a: { 2: 'b', 99999999: 'c' } });
  135. st.end();
  136. });
  137. t.test('supports malformed uri characters', function (st) {
  138. st.deepEqual(qs.parse('{%:%}', { strictNullHandling: true }), { '{%:%}': null });
  139. st.deepEqual(qs.parse('{%:%}='), { '{%:%}': '' });
  140. st.deepEqual(qs.parse('foo=%:%}'), { foo: '%:%}' });
  141. st.end();
  142. });
  143. t.test('doesn\'t produce empty keys', function (st) {
  144. st.deepEqual(qs.parse('_r=1&'), { _r: '1' });
  145. st.end();
  146. });
  147. t.test('cannot access Object prototype', function (st) {
  148. qs.parse('constructor[prototype][bad]=bad');
  149. qs.parse('bad[constructor][prototype][bad]=bad');
  150. st.equal(typeof Object.prototype.bad, 'undefined');
  151. st.end();
  152. });
  153. t.test('parses arrays of objects', function (st) {
  154. st.deepEqual(qs.parse('a[][b]=c'), { a: [{ b: 'c' }] });
  155. st.deepEqual(qs.parse('a[0][b]=c'), { a: [{ b: 'c' }] });
  156. st.end();
  157. });
  158. t.test('allows for empty strings in arrays', function (st) {
  159. st.deepEqual(qs.parse('a[]=b&a[]=&a[]=c'), { a: ['b', '', 'c'] });
  160. st.deepEqual(
  161. qs.parse('a[0]=b&a[1]&a[2]=c&a[19]=', { strictNullHandling: true, arrayLimit: 20 }),
  162. { a: ['b', null, 'c', ''] },
  163. 'with arrayLimit 20 + array indices: null then empty string works'
  164. );
  165. st.deepEqual(
  166. qs.parse('a[]=b&a[]&a[]=c&a[]=', { strictNullHandling: true, arrayLimit: 0 }),
  167. { a: ['b', null, 'c', ''] },
  168. 'with arrayLimit 0 + array brackets: null then empty string works'
  169. );
  170. st.deepEqual(
  171. qs.parse('a[0]=b&a[1]=&a[2]=c&a[19]', { strictNullHandling: true, arrayLimit: 20 }),
  172. { a: ['b', '', 'c', null] },
  173. 'with arrayLimit 20 + array indices: empty string then null works'
  174. );
  175. st.deepEqual(
  176. qs.parse('a[]=b&a[]=&a[]=c&a[]', { strictNullHandling: true, arrayLimit: 0 }),
  177. { a: ['b', '', 'c', null] },
  178. 'with arrayLimit 0 + array brackets: empty string then null works'
  179. );
  180. st.deepEqual(
  181. qs.parse('a[]=&a[]=b&a[]=c'),
  182. { a: ['', 'b', 'c'] },
  183. 'array brackets: empty strings work'
  184. );
  185. st.end();
  186. });
  187. t.test('compacts sparse arrays', function (st) {
  188. st.deepEqual(qs.parse('a[10]=1&a[2]=2', { arrayLimit: 20 }), { a: ['2', '1'] });
  189. st.deepEqual(qs.parse('a[1][b][2][c]=1', { arrayLimit: 20 }), { a: [{ b: [{ c: '1' }] }] });
  190. st.deepEqual(qs.parse('a[1][2][3][c]=1', { arrayLimit: 20 }), { a: [[[{ c: '1' }]]] });
  191. st.deepEqual(qs.parse('a[1][2][3][c][1]=1', { arrayLimit: 20 }), { a: [[[{ c: ['1'] }]]] });
  192. st.end();
  193. });
  194. t.test('parses semi-parsed strings', function (st) {
  195. st.deepEqual(qs.parse({ 'a[b]': 'c' }), { a: { b: 'c' } });
  196. st.deepEqual(qs.parse({ 'a[b]': 'c', 'a[d]': 'e' }), { a: { b: 'c', d: 'e' } });
  197. st.end();
  198. });
  199. t.test('parses buffers correctly', function (st) {
  200. var b = SaferBuffer.from('test');
  201. st.deepEqual(qs.parse({ a: b }), { a: b });
  202. st.end();
  203. });
  204. t.test('continues parsing when no parent is found', function (st) {
  205. st.deepEqual(qs.parse('[]=&a=b'), { 0: '', a: 'b' });
  206. st.deepEqual(qs.parse('[]&a=b', { strictNullHandling: true }), { 0: null, a: 'b' });
  207. st.deepEqual(qs.parse('[foo]=bar'), { foo: 'bar' });
  208. st.end();
  209. });
  210. t.test('does not error when parsing a very long array', function (st) {
  211. var str = 'a[]=a';
  212. while (Buffer.byteLength(str) < 128 * 1024) {
  213. str = str + '&' + str;
  214. }
  215. st.doesNotThrow(function () {
  216. qs.parse(str);
  217. });
  218. st.end();
  219. });
  220. t.test('should not throw when a native prototype has an enumerable property', function (st) {
  221. Object.prototype.crash = '';
  222. Array.prototype.crash = '';
  223. st.doesNotThrow(qs.parse.bind(null, 'a=b'));
  224. st.deepEqual(qs.parse('a=b'), { a: 'b' });
  225. st.doesNotThrow(qs.parse.bind(null, 'a[][b]=c'));
  226. st.deepEqual(qs.parse('a[][b]=c'), { a: [{ b: 'c' }] });
  227. delete Object.prototype.crash;
  228. delete Array.prototype.crash;
  229. st.end();
  230. });
  231. t.test('parses a string with an alternative string delimiter', function (st) {
  232. st.deepEqual(qs.parse('a=b;c=d', { delimiter: ';' }), { a: 'b', c: 'd' });
  233. st.end();
  234. });
  235. t.test('parses a string with an alternative RegExp delimiter', function (st) {
  236. st.deepEqual(qs.parse('a=b; c=d', { delimiter: /[;,] */ }), { a: 'b', c: 'd' });
  237. st.end();
  238. });
  239. t.test('does not use non-splittable objects as delimiters', function (st) {
  240. st.deepEqual(qs.parse('a=b&c=d', { delimiter: true }), { a: 'b', c: 'd' });
  241. st.end();
  242. });
  243. t.test('allows overriding parameter limit', function (st) {
  244. st.deepEqual(qs.parse('a=b&c=d', { parameterLimit: 1 }), { a: 'b' });
  245. st.end();
  246. });
  247. t.test('allows setting the parameter limit to Infinity', function (st) {
  248. st.deepEqual(qs.parse('a=b&c=d', { parameterLimit: Infinity }), { a: 'b', c: 'd' });
  249. st.end();
  250. });
  251. t.test('allows overriding array limit', function (st) {
  252. st.deepEqual(qs.parse('a[0]=b', { arrayLimit: -1 }), { a: { 0: 'b' } });
  253. st.deepEqual(qs.parse('a[-1]=b', { arrayLimit: -1 }), { a: { '-1': 'b' } });
  254. st.deepEqual(qs.parse('a[0]=b&a[1]=c', { arrayLimit: 0 }), { a: { 0: 'b', 1: 'c' } });
  255. st.end();
  256. });
  257. t.test('allows disabling array parsing', function (st) {
  258. var indices = qs.parse('a[0]=b&a[1]=c', { parseArrays: false });
  259. st.deepEqual(indices, { a: { 0: 'b', 1: 'c' } });
  260. st.equal(Array.isArray(indices.a), false, 'parseArrays:false, indices case is not an array');
  261. var emptyBrackets = qs.parse('a[]=b', { parseArrays: false });
  262. st.deepEqual(emptyBrackets, { a: { 0: 'b' } });
  263. st.equal(Array.isArray(emptyBrackets.a), false, 'parseArrays:false, empty brackets case is not an array');
  264. st.end();
  265. });
  266. t.test('parses an object', function (st) {
  267. var input = {
  268. 'user[name]': { 'pop[bob]': 3 },
  269. 'user[email]': null
  270. };
  271. var expected = {
  272. user: {
  273. name: { 'pop[bob]': 3 },
  274. email: null
  275. }
  276. };
  277. var result = qs.parse(input);
  278. st.deepEqual(result, expected);
  279. st.end();
  280. });
  281. t.test('parses an object in dot notation', function (st) {
  282. var input = {
  283. 'user.name': { 'pop[bob]': 3 },
  284. 'user.email.': null
  285. };
  286. var expected = {
  287. user: {
  288. name: { 'pop[bob]': 3 },
  289. email: null
  290. }
  291. };
  292. var result = qs.parse(input, { allowDots: true });
  293. st.deepEqual(result, expected);
  294. st.end();
  295. });
  296. t.test('parses an object and not child values', function (st) {
  297. var input = {
  298. 'user[name]': { 'pop[bob]': { test: 3 } },
  299. 'user[email]': null
  300. };
  301. var expected = {
  302. user: {
  303. name: { 'pop[bob]': { test: 3 } },
  304. email: null
  305. }
  306. };
  307. var result = qs.parse(input);
  308. st.deepEqual(result, expected);
  309. st.end();
  310. });
  311. t.test('does not blow up when Buffer global is missing', function (st) {
  312. var tempBuffer = global.Buffer;
  313. delete global.Buffer;
  314. var result = qs.parse('a=b&c=d');
  315. global.Buffer = tempBuffer;
  316. st.deepEqual(result, { a: 'b', c: 'd' });
  317. st.end();
  318. });
  319. t.test('does not crash when parsing circular references', function (st) {
  320. var a = {};
  321. a.b = a;
  322. var parsed;
  323. st.doesNotThrow(function () {
  324. parsed = qs.parse({ 'foo[bar]': 'baz', 'foo[baz]': a });
  325. });
  326. st.equal('foo' in parsed, true, 'parsed has "foo" property');
  327. st.equal('bar' in parsed.foo, true);
  328. st.equal('baz' in parsed.foo, true);
  329. st.equal(parsed.foo.bar, 'baz');
  330. st.deepEqual(parsed.foo.baz, a);
  331. st.end();
  332. });
  333. t.test('parses null objects correctly', { skip: !Object.create }, function (st) {
  334. var a = Object.create(null);
  335. a.b = 'c';
  336. st.deepEqual(qs.parse(a), { b: 'c' });
  337. var result = qs.parse({ a: a });
  338. st.equal('a' in result, true, 'result has "a" property');
  339. st.deepEqual(result.a, a);
  340. st.end();
  341. });
  342. t.test('parses dates correctly', function (st) {
  343. var now = new Date();
  344. st.deepEqual(qs.parse({ a: now }), { a: now });
  345. st.end();
  346. });
  347. t.test('parses regular expressions correctly', function (st) {
  348. var re = /^test$/;
  349. st.deepEqual(qs.parse({ a: re }), { a: re });
  350. st.end();
  351. });
  352. t.test('does not allow overwriting prototype properties', function (st) {
  353. st.deepEqual(qs.parse('a[hasOwnProperty]=b', { allowPrototypes: false }), {});
  354. st.deepEqual(qs.parse('hasOwnProperty=b', { allowPrototypes: false }), {});
  355. st.deepEqual(
  356. qs.parse('toString', { allowPrototypes: false }),
  357. {},
  358. 'bare "toString" results in {}'
  359. );
  360. st.end();
  361. });
  362. t.test('can allow overwriting prototype properties', function (st) {
  363. st.deepEqual(qs.parse('a[hasOwnProperty]=b', { allowPrototypes: true }), { a: { hasOwnProperty: 'b' } });
  364. st.deepEqual(qs.parse('hasOwnProperty=b', { allowPrototypes: true }), { hasOwnProperty: 'b' });
  365. st.deepEqual(
  366. qs.parse('toString', { allowPrototypes: true }),
  367. { toString: '' },
  368. 'bare "toString" results in { toString: "" }'
  369. );
  370. st.end();
  371. });
  372. t.test('params starting with a closing bracket', function (st) {
  373. st.deepEqual(qs.parse(']=toString'), { ']': 'toString' });
  374. st.deepEqual(qs.parse(']]=toString'), { ']]': 'toString' });
  375. st.deepEqual(qs.parse(']hello]=toString'), { ']hello]': 'toString' });
  376. st.end();
  377. });
  378. t.test('params starting with a starting bracket', function (st) {
  379. st.deepEqual(qs.parse('[=toString'), { '[': 'toString' });
  380. st.deepEqual(qs.parse('[[=toString'), { '[[': 'toString' });
  381. st.deepEqual(qs.parse('[hello[=toString'), { '[hello[': 'toString' });
  382. st.end();
  383. });
  384. t.test('add keys to objects', function (st) {
  385. st.deepEqual(
  386. qs.parse('a[b]=c&a=d'),
  387. { a: { b: 'c', d: true } },
  388. 'can add keys to objects'
  389. );
  390. st.deepEqual(
  391. qs.parse('a[b]=c&a=toString'),
  392. { a: { b: 'c' } },
  393. 'can not overwrite prototype'
  394. );
  395. st.deepEqual(
  396. qs.parse('a[b]=c&a=toString', { allowPrototypes: true }),
  397. { a: { b: 'c', toString: true } },
  398. 'can overwrite prototype with allowPrototypes true'
  399. );
  400. st.deepEqual(
  401. qs.parse('a[b]=c&a=toString', { plainObjects: true }),
  402. { __proto__: null, a: { __proto__: null, b: 'c', toString: true } },
  403. 'can overwrite prototype with plainObjects true'
  404. );
  405. st.end();
  406. });
  407. t.test('dunder proto is ignored', function (st) {
  408. var payload = 'categories[__proto__]=login&categories[__proto__]&categories[length]=42';
  409. var result = qs.parse(payload, { allowPrototypes: true });
  410. st.deepEqual(
  411. result,
  412. {
  413. categories: {
  414. length: '42'
  415. }
  416. },
  417. 'silent [[Prototype]] payload'
  418. );
  419. var plainResult = qs.parse(payload, { allowPrototypes: true, plainObjects: true });
  420. st.deepEqual(
  421. plainResult,
  422. {
  423. __proto__: null,
  424. categories: {
  425. __proto__: null,
  426. length: '42'
  427. }
  428. },
  429. 'silent [[Prototype]] payload: plain objects'
  430. );
  431. var query = qs.parse('categories[__proto__]=cats&categories[__proto__]=dogs&categories[some][json]=toInject', { allowPrototypes: true });
  432. st.notOk(Array.isArray(query.categories), 'is not an array');
  433. st.notOk(query.categories instanceof Array, 'is not instanceof an array');
  434. st.deepEqual(query.categories, { some: { json: 'toInject' } });
  435. st.equal(JSON.stringify(query.categories), '{"some":{"json":"toInject"}}', 'stringifies as a non-array');
  436. st.deepEqual(
  437. qs.parse('foo[__proto__][hidden]=value&foo[bar]=stuffs', { allowPrototypes: true }),
  438. {
  439. foo: {
  440. bar: 'stuffs'
  441. }
  442. },
  443. 'hidden values'
  444. );
  445. st.deepEqual(
  446. qs.parse('foo[__proto__][hidden]=value&foo[bar]=stuffs', { allowPrototypes: true, plainObjects: true }),
  447. {
  448. __proto__: null,
  449. foo: {
  450. __proto__: null,
  451. bar: 'stuffs'
  452. }
  453. },
  454. 'hidden values: plain objects'
  455. );
  456. st.end();
  457. });
  458. t.test('can return null objects', { skip: !Object.create }, function (st) {
  459. var expected = Object.create(null);
  460. expected.a = Object.create(null);
  461. expected.a.b = 'c';
  462. expected.a.hasOwnProperty = 'd';
  463. st.deepEqual(qs.parse('a[b]=c&a[hasOwnProperty]=d', { plainObjects: true }), expected);
  464. st.deepEqual(qs.parse(null, { plainObjects: true }), Object.create(null));
  465. var expectedArray = Object.create(null);
  466. expectedArray.a = Object.create(null);
  467. expectedArray.a[0] = 'b';
  468. expectedArray.a.c = 'd';
  469. st.deepEqual(qs.parse('a[]=b&a[c]=d', { plainObjects: true }), expectedArray);
  470. st.end();
  471. });
  472. t.test('can parse with custom encoding', function (st) {
  473. st.deepEqual(qs.parse('%8c%a7=%91%e5%8d%e3%95%7b', {
  474. decoder: function (str) {
  475. var reg = /%([0-9A-F]{2})/ig;
  476. var result = [];
  477. var parts = reg.exec(str);
  478. while (parts) {
  479. result.push(parseInt(parts[1], 16));
  480. parts = reg.exec(str);
  481. }
  482. return iconv.decode(SaferBuffer.from(result), 'shift_jis').toString();
  483. }
  484. }), { 県: '大阪府' });
  485. st.end();
  486. });
  487. t.test('throws error with wrong decoder', function (st) {
  488. st['throws'](function () {
  489. qs.parse({}, { decoder: 'string' });
  490. }, new TypeError('Decoder has to be a function.'));
  491. st.end();
  492. });
  493. });