parse.js 64 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654
  1. 'use strict';
  2. var test = require('tape');
  3. var hasPropertyDescriptors = require('has-property-descriptors')();
  4. var iconv = require('iconv-lite');
  5. var mockProperty = require('mock-property');
  6. var hasOverrideMistake = require('has-override-mistake')();
  7. var SaferBuffer = require('safer-buffer').Buffer;
  8. var v = require('es-value-fixtures');
  9. var inspect = require('object-inspect');
  10. var emptyTestCases = require('./empty-keys-cases').emptyTestCases;
  11. var hasProto = require('has-proto')();
  12. var qs = require('../');
  13. var utils = require('../lib/utils');
  14. test('parse()', function (t) {
  15. t.test('parses a simple string', function (st) {
  16. st.deepEqual(qs.parse('0=foo'), { 0: 'foo' });
  17. st.deepEqual(qs.parse('foo=c++'), { foo: 'c ' });
  18. st.deepEqual(qs.parse('a[>=]=23'), { a: { '>=': '23' } });
  19. st.deepEqual(qs.parse('a[<=>]==23'), { a: { '<=>': '=23' } });
  20. st.deepEqual(qs.parse('a[==]=23'), { a: { '==': '23' } });
  21. st.deepEqual(qs.parse('foo', { strictNullHandling: true }), { foo: null });
  22. st.deepEqual(qs.parse('foo'), { foo: '' });
  23. st.deepEqual(qs.parse('foo='), { foo: '' });
  24. st.deepEqual(qs.parse('foo=bar'), { foo: 'bar' });
  25. st.deepEqual(qs.parse(' foo = bar = baz '), { ' foo ': ' bar = baz ' });
  26. st.deepEqual(qs.parse('foo=bar=baz'), { foo: 'bar=baz' });
  27. st.deepEqual(qs.parse('foo=bar&bar=baz'), { foo: 'bar', bar: 'baz' });
  28. st.deepEqual(qs.parse('foo2=bar2&baz2='), { foo2: 'bar2', baz2: '' });
  29. st.deepEqual(qs.parse('foo=bar&baz', { strictNullHandling: true }), { foo: 'bar', baz: null });
  30. st.deepEqual(qs.parse('foo=bar&baz'), { foo: 'bar', baz: '' });
  31. st.deepEqual(qs.parse('cht=p3&chd=t:60,40&chs=250x100&chl=Hello|World'), {
  32. cht: 'p3',
  33. chd: 't:60,40',
  34. chs: '250x100',
  35. chl: 'Hello|World'
  36. });
  37. st.end();
  38. });
  39. t.test('comma: false', function (st) {
  40. st.deepEqual(qs.parse('a[]=b&a[]=c'), { a: ['b', 'c'] });
  41. st.deepEqual(qs.parse('a[0]=b&a[1]=c'), { a: ['b', 'c'] });
  42. st.deepEqual(qs.parse('a=b,c'), { a: 'b,c' });
  43. st.deepEqual(qs.parse('a=b&a=c'), { a: ['b', 'c'] });
  44. st.end();
  45. });
  46. t.test('comma: true', function (st) {
  47. st.deepEqual(qs.parse('a[]=b&a[]=c', { comma: true }), { a: ['b', 'c'] });
  48. st.deepEqual(qs.parse('a[0]=b&a[1]=c', { comma: true }), { a: ['b', 'c'] });
  49. st.deepEqual(qs.parse('a=b,c', { comma: true }), { a: ['b', 'c'] });
  50. st.deepEqual(qs.parse('a=b&a=c', { comma: true }), { a: ['b', 'c'] });
  51. st.end();
  52. });
  53. t.test('allows enabling dot notation', function (st) {
  54. st.deepEqual(qs.parse('a.b=c'), { 'a.b': 'c' });
  55. st.deepEqual(qs.parse('a.b=c', { allowDots: true }), { a: { b: 'c' } });
  56. st.end();
  57. });
  58. t.test('decode dot keys correctly', function (st) {
  59. st.deepEqual(
  60. qs.parse('name%252Eobj.first=John&name%252Eobj.last=Doe', { allowDots: false, decodeDotInKeys: false }),
  61. { 'name%2Eobj.first': 'John', 'name%2Eobj.last': 'Doe' },
  62. 'with allowDots false and decodeDotInKeys false'
  63. );
  64. st.deepEqual(
  65. qs.parse('name.obj.first=John&name.obj.last=Doe', { allowDots: true, decodeDotInKeys: false }),
  66. { name: { obj: { first: 'John', last: 'Doe' } } },
  67. 'with allowDots false and decodeDotInKeys false'
  68. );
  69. st.deepEqual(
  70. qs.parse('name%252Eobj.first=John&name%252Eobj.last=Doe', { allowDots: true, decodeDotInKeys: false }),
  71. { 'name%2Eobj': { first: 'John', last: 'Doe' } },
  72. 'with allowDots true and decodeDotInKeys false'
  73. );
  74. st.deepEqual(
  75. qs.parse('name%252Eobj.first=John&name%252Eobj.last=Doe', { allowDots: true, decodeDotInKeys: true }),
  76. { 'name.obj': { first: 'John', last: 'Doe' } },
  77. 'with allowDots true and decodeDotInKeys true'
  78. );
  79. st.deepEqual(
  80. qs.parse(
  81. 'name%252Eobj%252Esubobject.first%252Egodly%252Ename=John&name%252Eobj%252Esubobject.last=Doe',
  82. { allowDots: false, decodeDotInKeys: false }
  83. ),
  84. { 'name%2Eobj%2Esubobject.first%2Egodly%2Ename': 'John', 'name%2Eobj%2Esubobject.last': 'Doe' },
  85. 'with allowDots false and decodeDotInKeys false'
  86. );
  87. st.deepEqual(
  88. qs.parse(
  89. 'name.obj.subobject.first.godly.name=John&name.obj.subobject.last=Doe',
  90. { allowDots: true, decodeDotInKeys: false }
  91. ),
  92. { name: { obj: { subobject: { first: { godly: { name: 'John' } }, last: 'Doe' } } } },
  93. 'with allowDots true and decodeDotInKeys false'
  94. );
  95. st.deepEqual(
  96. qs.parse(
  97. 'name%252Eobj%252Esubobject.first%252Egodly%252Ename=John&name%252Eobj%252Esubobject.last=Doe',
  98. { allowDots: true, decodeDotInKeys: true }
  99. ),
  100. { 'name.obj.subobject': { 'first.godly.name': 'John', last: 'Doe' } },
  101. 'with allowDots true and decodeDotInKeys true'
  102. );
  103. st.deepEqual(
  104. qs.parse('name%252Eobj.first=John&name%252Eobj.last=Doe'),
  105. { 'name%2Eobj.first': 'John', 'name%2Eobj.last': 'Doe' },
  106. 'with allowDots and decodeDotInKeys undefined'
  107. );
  108. st.end();
  109. });
  110. t.test('decodes dot in key of object, and allow enabling dot notation when decodeDotInKeys is set to true and allowDots is undefined', function (st) {
  111. st.deepEqual(
  112. qs.parse(
  113. 'name%252Eobj%252Esubobject.first%252Egodly%252Ename=John&name%252Eobj%252Esubobject.last=Doe',
  114. { decodeDotInKeys: true }
  115. ),
  116. { 'name.obj.subobject': { 'first.godly.name': 'John', last: 'Doe' } },
  117. 'with allowDots undefined and decodeDotInKeys true'
  118. );
  119. st.end();
  120. });
  121. t.test('throws when decodeDotInKeys is not of type boolean', function (st) {
  122. st['throws'](
  123. function () { qs.parse('foo[]&bar=baz', { decodeDotInKeys: 'foobar' }); },
  124. TypeError
  125. );
  126. st['throws'](
  127. function () { qs.parse('foo[]&bar=baz', { decodeDotInKeys: 0 }); },
  128. TypeError
  129. );
  130. st['throws'](
  131. function () { qs.parse('foo[]&bar=baz', { decodeDotInKeys: NaN }); },
  132. TypeError
  133. );
  134. st['throws'](
  135. function () { qs.parse('foo[]&bar=baz', { decodeDotInKeys: null }); },
  136. TypeError
  137. );
  138. st.end();
  139. });
  140. t.test('allows empty arrays in obj values', function (st) {
  141. st.deepEqual(qs.parse('foo[]&bar=baz', { allowEmptyArrays: true }), { foo: [], bar: 'baz' });
  142. st.deepEqual(qs.parse('foo[]&bar=baz', { allowEmptyArrays: false }), { foo: [''], bar: 'baz' });
  143. st.end();
  144. });
  145. t.test('throws when allowEmptyArrays is not of type boolean', function (st) {
  146. st['throws'](
  147. function () { qs.parse('foo[]&bar=baz', { allowEmptyArrays: 'foobar' }); },
  148. TypeError
  149. );
  150. st['throws'](
  151. function () { qs.parse('foo[]&bar=baz', { allowEmptyArrays: 0 }); },
  152. TypeError
  153. );
  154. st['throws'](
  155. function () { qs.parse('foo[]&bar=baz', { allowEmptyArrays: NaN }); },
  156. TypeError
  157. );
  158. st['throws'](
  159. function () { qs.parse('foo[]&bar=baz', { allowEmptyArrays: null }); },
  160. TypeError
  161. );
  162. st.end();
  163. });
  164. t.test('allowEmptyArrays + strictNullHandling', function (st) {
  165. st.deepEqual(
  166. qs.parse('testEmptyArray[]', { strictNullHandling: true, allowEmptyArrays: true }),
  167. { testEmptyArray: [] }
  168. );
  169. st.end();
  170. });
  171. t.deepEqual(qs.parse('a[b]=c'), { a: { b: 'c' } }, 'parses a single nested string');
  172. t.deepEqual(qs.parse('a[b][c]=d'), { a: { b: { c: 'd' } } }, 'parses a double nested string');
  173. t.deepEqual(
  174. qs.parse('a[b][c][d][e][f][g][h]=i'),
  175. { a: { b: { c: { d: { e: { f: { '[g][h]': 'i' } } } } } } },
  176. 'defaults to a depth of 5'
  177. );
  178. t.test('only parses one level when depth = 1', function (st) {
  179. st.deepEqual(qs.parse('a[b][c]=d', { depth: 1 }), { a: { b: { '[c]': 'd' } } });
  180. st.deepEqual(qs.parse('a[b][c][d]=e', { depth: 1 }), { a: { b: { '[c][d]': 'e' } } });
  181. st.end();
  182. });
  183. t.test('uses original key when depth = 0', function (st) {
  184. st.deepEqual(qs.parse('a[0]=b&a[1]=c', { depth: 0 }), { 'a[0]': 'b', 'a[1]': 'c' });
  185. st.deepEqual(qs.parse('a[0][0]=b&a[0][1]=c&a[1]=d&e=2', { depth: 0 }), { 'a[0][0]': 'b', 'a[0][1]': 'c', 'a[1]': 'd', e: '2' });
  186. st.end();
  187. });
  188. t.test('ignores prototype keys when depth = 0 and allowPrototypes is false', function (st) {
  189. st.deepEqual(qs.parse('toString=foo', { depth: 0 }), {});
  190. st.deepEqual(qs.parse('hasOwnProperty=bar', { depth: 0 }), {});
  191. st.deepEqual(qs.parse('toString=foo&a=b', { depth: 0 }), { a: 'b' });
  192. st.end();
  193. });
  194. t.test('allows prototype keys when depth = 0 and allowPrototypes is true', function (st) {
  195. st.deepEqual(qs.parse('toString=foo', { depth: 0, allowPrototypes: true }), { toString: 'foo' });
  196. st.end();
  197. });
  198. t.test('uses original key when depth = false', function (st) {
  199. st.deepEqual(qs.parse('a[0]=b&a[1]=c', { depth: false }), { 'a[0]': 'b', 'a[1]': 'c' });
  200. st.deepEqual(qs.parse('a[0][0]=b&a[0][1]=c&a[1]=d&e=2', { depth: false }), { 'a[0][0]': 'b', 'a[0][1]': 'c', 'a[1]': 'd', e: '2' });
  201. st.end();
  202. });
  203. t.deepEqual(qs.parse('a=b&a=c'), { a: ['b', 'c'] }, 'parses a simple array');
  204. t.test('parses an explicit array', function (st) {
  205. st.deepEqual(qs.parse('a[]=b'), { a: ['b'] });
  206. st.deepEqual(qs.parse('a[]=b&a[]=c'), { a: ['b', 'c'] });
  207. st.deepEqual(qs.parse('a[]=b&a[]=c&a[]=d'), { a: ['b', 'c', 'd'] });
  208. st.end();
  209. });
  210. t.test('parses a mix of simple and explicit arrays', function (st) {
  211. st.deepEqual(qs.parse('a=b&a[]=c'), { a: ['b', 'c'] });
  212. st.deepEqual(qs.parse('a[]=b&a=c'), { a: ['b', 'c'] });
  213. st.deepEqual(qs.parse('a[0]=b&a=c'), { a: ['b', 'c'] });
  214. st.deepEqual(qs.parse('a=b&a[0]=c'), { a: ['b', 'c'] });
  215. st.deepEqual(qs.parse('a[1]=b&a=c', { arrayLimit: 20 }), { a: ['b', 'c'] });
  216. st.deepEqual(qs.parse('a[]=b&a=c', { arrayLimit: 0 }), { a: { 0: 'b', 1: 'c' } });
  217. st.deepEqual(qs.parse('a[]=b&a=c'), { a: ['b', 'c'] });
  218. st.deepEqual(qs.parse('a=b&a[1]=c', { arrayLimit: 20 }), { a: ['b', 'c'] });
  219. st.deepEqual(qs.parse('a=b&a[]=c', { arrayLimit: 0 }), { a: { 0: 'b', 1: 'c' } });
  220. st.deepEqual(qs.parse('a=b&a[]=c'), { a: ['b', 'c'] });
  221. st.end();
  222. });
  223. t.test('parses a nested array', function (st) {
  224. st.deepEqual(qs.parse('a[b][]=c&a[b][]=d'), { a: { b: ['c', 'd'] } });
  225. st.deepEqual(qs.parse('a[>=]=25'), { a: { '>=': '25' } });
  226. st.end();
  227. });
  228. t.test('allows to specify array indices', function (st) {
  229. st.deepEqual(qs.parse('a[1]=c&a[0]=b&a[2]=d'), { a: ['b', 'c', 'd'] });
  230. st.deepEqual(qs.parse('a[1]=c&a[0]=b'), { a: ['b', 'c'] });
  231. st.deepEqual(qs.parse('a[1]=c', { arrayLimit: 20 }), { a: ['c'] });
  232. st.deepEqual(qs.parse('a[1]=c', { arrayLimit: 0 }), { a: { 1: 'c' } });
  233. st.deepEqual(qs.parse('a[1]=c'), { a: ['c'] });
  234. st.end();
  235. });
  236. t.test('limits specific array indices to arrayLimit', function (st) {
  237. st.deepEqual(qs.parse('a[19]=a', { arrayLimit: 20 }), { a: ['a'] });
  238. st.deepEqual(qs.parse('a[20]=a', { arrayLimit: 20 }), { a: { 20: 'a' } });
  239. st.deepEqual(qs.parse('a[19]=a'), { a: ['a'] });
  240. st.deepEqual(qs.parse('a[20]=a'), { a: { 20: 'a' } });
  241. st.end();
  242. });
  243. t.deepEqual(qs.parse('a[12b]=c'), { a: { '12b': 'c' } }, 'supports keys that begin with a number');
  244. t.test('supports encoded = signs', function (st) {
  245. st.deepEqual(qs.parse('he%3Dllo=th%3Dere'), { 'he=llo': 'th=ere' });
  246. st.end();
  247. });
  248. t.test('is ok with url encoded strings', function (st) {
  249. st.deepEqual(qs.parse('a[b%20c]=d'), { a: { 'b c': 'd' } });
  250. st.deepEqual(qs.parse('a[b]=c%20d'), { a: { b: 'c d' } });
  251. st.end();
  252. });
  253. t.test('allows brackets in the value', function (st) {
  254. st.deepEqual(qs.parse('pets=["tobi"]'), { pets: '["tobi"]' });
  255. st.deepEqual(qs.parse('operators=[">=", "<="]'), { operators: '[">=", "<="]' });
  256. st.end();
  257. });
  258. t.test('allows empty values', function (st) {
  259. st.deepEqual(qs.parse(''), {});
  260. st.deepEqual(qs.parse(null), {});
  261. st.deepEqual(qs.parse(undefined), {});
  262. st.end();
  263. });
  264. t.test('transforms arrays to objects', function (st) {
  265. st.deepEqual(qs.parse('foo[0]=bar&foo[bad]=baz'), { foo: { 0: 'bar', bad: 'baz' } });
  266. st.deepEqual(qs.parse('foo[bad]=baz&foo[0]=bar'), { foo: { bad: 'baz', 0: 'bar' } });
  267. st.deepEqual(qs.parse('foo[bad]=baz&foo[]=bar'), { foo: { bad: 'baz', 0: 'bar' } });
  268. st.deepEqual(qs.parse('foo[]=bar&foo[bad]=baz'), { foo: { 0: 'bar', bad: 'baz' } });
  269. st.deepEqual(qs.parse('foo[bad]=baz&foo[]=bar&foo[]=foo'), { foo: { bad: 'baz', 0: 'bar', 1: 'foo' } });
  270. st.deepEqual(qs.parse('foo[0][a]=a&foo[0][b]=b&foo[1][a]=aa&foo[1][b]=bb'), { foo: [{ a: 'a', b: 'b' }, { a: 'aa', b: 'bb' }] });
  271. st.deepEqual(qs.parse('a[]=b&a[t]=u&a[hasOwnProperty]=c', { allowPrototypes: false }), { a: { 0: 'b', t: 'u' } });
  272. st.deepEqual(qs.parse('a[]=b&a[t]=u&a[hasOwnProperty]=c', { allowPrototypes: true }), { a: { 0: 'b', t: 'u', hasOwnProperty: 'c' } });
  273. st.deepEqual(qs.parse('a[]=b&a[hasOwnProperty]=c&a[x]=y', { allowPrototypes: false }), { a: { 0: 'b', x: 'y' } });
  274. st.deepEqual(qs.parse('a[]=b&a[hasOwnProperty]=c&a[x]=y', { allowPrototypes: true }), { a: { 0: 'b', hasOwnProperty: 'c', x: 'y' } });
  275. st.end();
  276. });
  277. t.test('transforms arrays to objects (dot notation)', function (st) {
  278. st.deepEqual(qs.parse('foo[0].baz=bar&fool.bad=baz', { allowDots: true }), { foo: [{ baz: 'bar' }], fool: { bad: 'baz' } });
  279. st.deepEqual(qs.parse('foo[0].baz=bar&fool.bad.boo=baz', { allowDots: true }), { foo: [{ baz: 'bar' }], fool: { bad: { boo: 'baz' } } });
  280. st.deepEqual(qs.parse('foo[0][0].baz=bar&fool.bad=baz', { allowDots: true }), { foo: [[{ baz: 'bar' }]], fool: { bad: 'baz' } });
  281. st.deepEqual(qs.parse('foo[0].baz[0]=15&foo[0].bar=2', { allowDots: true }), { foo: [{ baz: ['15'], bar: '2' }] });
  282. st.deepEqual(qs.parse('foo[0].baz[0]=15&foo[0].baz[1]=16&foo[0].bar=2', { allowDots: true }), { foo: [{ baz: ['15', '16'], bar: '2' }] });
  283. st.deepEqual(qs.parse('foo.bad=baz&foo[0]=bar', { allowDots: true }), { foo: { bad: 'baz', 0: 'bar' } });
  284. st.deepEqual(qs.parse('foo.bad=baz&foo[]=bar', { allowDots: true }), { foo: { bad: 'baz', 0: 'bar' } });
  285. st.deepEqual(qs.parse('foo[]=bar&foo.bad=baz', { allowDots: true }), { foo: { 0: 'bar', bad: 'baz' } });
  286. st.deepEqual(qs.parse('foo.bad=baz&foo[]=bar&foo[]=foo', { allowDots: true }), { foo: { bad: 'baz', 0: 'bar', 1: 'foo' } });
  287. st.deepEqual(qs.parse('foo[0].a=a&foo[0].b=b&foo[1].a=aa&foo[1].b=bb', { allowDots: true }), { foo: [{ a: 'a', b: 'b' }, { a: 'aa', b: 'bb' }] });
  288. st.end();
  289. });
  290. t.test('correctly prunes undefined values when converting an array to an object', function (st) {
  291. st.deepEqual(qs.parse('a[2]=b&a[99999999]=c'), { a: { 2: 'b', 99999999: 'c' } });
  292. st.end();
  293. });
  294. t.test('supports malformed uri characters', function (st) {
  295. st.deepEqual(qs.parse('{%:%}', { strictNullHandling: true }), { '{%:%}': null });
  296. st.deepEqual(qs.parse('{%:%}='), { '{%:%}': '' });
  297. st.deepEqual(qs.parse('foo=%:%}'), { foo: '%:%}' });
  298. st.end();
  299. });
  300. t.test('doesn\'t produce empty keys', function (st) {
  301. st.deepEqual(qs.parse('_r=1&'), { _r: '1' });
  302. st.end();
  303. });
  304. t.test('cannot access Object prototype', function (st) {
  305. qs.parse('constructor[prototype][bad]=bad');
  306. qs.parse('bad[constructor][prototype][bad]=bad');
  307. st.equal(typeof Object.prototype.bad, 'undefined');
  308. st.end();
  309. });
  310. t.test('parses arrays of objects', function (st) {
  311. st.deepEqual(qs.parse('a[][b]=c'), { a: [{ b: 'c' }] });
  312. st.deepEqual(qs.parse('a[0][b]=c'), { a: [{ b: 'c' }] });
  313. st.end();
  314. });
  315. t.test('allows for empty strings in arrays', function (st) {
  316. st.deepEqual(qs.parse('a[]=b&a[]=&a[]=c'), { a: ['b', '', 'c'] });
  317. st.deepEqual(
  318. qs.parse('a[0]=b&a[1]&a[2]=c&a[19]=', { strictNullHandling: true, arrayLimit: 20 }),
  319. { a: ['b', null, 'c', ''] },
  320. 'with arrayLimit 20 + array indices: null then empty string works'
  321. );
  322. st.deepEqual(
  323. qs.parse('a[]=b&a[]&a[]=c&a[]=', { strictNullHandling: true, arrayLimit: 0 }),
  324. { a: { 0: 'b', 1: null, 2: 'c', 3: '' } },
  325. 'with arrayLimit 0 + array brackets: null then empty string works'
  326. );
  327. st.deepEqual(
  328. qs.parse('a[0]=b&a[1]=&a[2]=c&a[19]', { strictNullHandling: true, arrayLimit: 20 }),
  329. { a: ['b', '', 'c', null] },
  330. 'with arrayLimit 20 + array indices: empty string then null works'
  331. );
  332. st.deepEqual(
  333. qs.parse('a[]=b&a[]=&a[]=c&a[]', { strictNullHandling: true, arrayLimit: 0 }),
  334. { a: { 0: 'b', 1: '', 2: 'c', 3: null } },
  335. 'with arrayLimit 0 + array brackets: empty string then null works'
  336. );
  337. st.deepEqual(
  338. qs.parse('a[]=&a[]=b&a[]=c'),
  339. { a: ['', 'b', 'c'] },
  340. 'array brackets: empty strings work'
  341. );
  342. st.end();
  343. });
  344. t.test('compacts sparse arrays', function (st) {
  345. st.deepEqual(qs.parse('a[10]=1&a[2]=2', { arrayLimit: 20 }), { a: ['2', '1'] });
  346. st.deepEqual(qs.parse('a[1][b][2][c]=1', { arrayLimit: 20 }), { a: [{ b: [{ c: '1' }] }] });
  347. st.deepEqual(qs.parse('a[1][2][3][c]=1', { arrayLimit: 20 }), { a: [[[{ c: '1' }]]] });
  348. st.deepEqual(qs.parse('a[1][2][3][c][1]=1', { arrayLimit: 20 }), { a: [[[{ c: ['1'] }]]] });
  349. st.end();
  350. });
  351. t.test('parses sparse arrays', function (st) {
  352. /* eslint no-sparse-arrays: 0 */
  353. st.deepEqual(qs.parse('a[4]=1&a[1]=2', { allowSparse: true }), { a: [, '2', , , '1'] });
  354. st.deepEqual(qs.parse('a[1][b][2][c]=1', { allowSparse: true }), { a: [, { b: [, , { c: '1' }] }] });
  355. st.deepEqual(qs.parse('a[1][2][3][c]=1', { allowSparse: true }), { a: [, [, , [, , , { c: '1' }]]] });
  356. st.deepEqual(qs.parse('a[1][2][3][c][1]=1', { allowSparse: true }), { a: [, [, , [, , , { c: [, '1'] }]]] });
  357. st.end();
  358. });
  359. t.test('parses semi-parsed strings', function (st) {
  360. st.deepEqual(qs.parse({ 'a[b]': 'c' }), { a: { b: 'c' } });
  361. st.deepEqual(qs.parse({ 'a[b]': 'c', 'a[d]': 'e' }), { a: { b: 'c', d: 'e' } });
  362. st.end();
  363. });
  364. t.test('parses buffers correctly', function (st) {
  365. var b = SaferBuffer.from('test');
  366. st.deepEqual(qs.parse({ a: b }), { a: b });
  367. st.end();
  368. });
  369. t.test('parses jquery-param strings', function (st) {
  370. // readable = 'filter[0][]=int1&filter[0][]==&filter[0][]=77&filter[]=and&filter[2][]=int2&filter[2][]==&filter[2][]=8'
  371. var encoded = 'filter%5B0%5D%5B%5D=int1&filter%5B0%5D%5B%5D=%3D&filter%5B0%5D%5B%5D=77&filter%5B%5D=and&filter%5B2%5D%5B%5D=int2&filter%5B2%5D%5B%5D=%3D&filter%5B2%5D%5B%5D=8';
  372. var expected = { filter: [['int1', '=', '77'], 'and', ['int2', '=', '8']] };
  373. st.deepEqual(qs.parse(encoded), expected);
  374. st.end();
  375. });
  376. t.test('continues parsing when no parent is found', function (st) {
  377. st.deepEqual(qs.parse('[]=&a=b'), { 0: '', a: 'b' });
  378. st.deepEqual(qs.parse('[]&a=b', { strictNullHandling: true }), { 0: null, a: 'b' });
  379. st.deepEqual(qs.parse('[foo]=bar'), { foo: 'bar' });
  380. st.end();
  381. });
  382. t.test('does not error when parsing a very long array', function (st) {
  383. var str = 'a[]=a';
  384. while (Buffer.byteLength(str) < 128 * 1024) {
  385. str = str + '&' + str;
  386. }
  387. st.doesNotThrow(function () {
  388. qs.parse(str);
  389. });
  390. st.end();
  391. });
  392. t.test('does not throw when a native prototype has an enumerable property', function (st) {
  393. st.intercept(Object.prototype, 'crash', { value: '' });
  394. st.intercept(Array.prototype, 'crash', { value: '' });
  395. st.doesNotThrow(qs.parse.bind(null, 'a=b'));
  396. st.deepEqual(qs.parse('a=b'), { a: 'b' });
  397. st.doesNotThrow(qs.parse.bind(null, 'a[][b]=c'));
  398. st.deepEqual(qs.parse('a[][b]=c'), { a: [{ b: 'c' }] });
  399. st.end();
  400. });
  401. t.test('parses a string with an alternative string delimiter', function (st) {
  402. st.deepEqual(qs.parse('a=b;c=d', { delimiter: ';' }), { a: 'b', c: 'd' });
  403. st.end();
  404. });
  405. t.test('parses a string with an alternative RegExp delimiter', function (st) {
  406. st.deepEqual(qs.parse('a=b; c=d', { delimiter: /[;,] */ }), { a: 'b', c: 'd' });
  407. st.end();
  408. });
  409. t.test('does not use non-splittable objects as delimiters', function (st) {
  410. st.deepEqual(qs.parse('a=b&c=d', { delimiter: true }), { a: 'b', c: 'd' });
  411. st.end();
  412. });
  413. t.test('allows overriding parameter limit', function (st) {
  414. st.deepEqual(qs.parse('a=b&c=d', { parameterLimit: 1 }), { a: 'b' });
  415. st.end();
  416. });
  417. t.test('allows setting the parameter limit to Infinity', function (st) {
  418. st.deepEqual(qs.parse('a=b&c=d', { parameterLimit: Infinity }), { a: 'b', c: 'd' });
  419. st.end();
  420. });
  421. t.test('allows overriding array limit', function (st) {
  422. st.deepEqual(qs.parse('a[0]=b', { arrayLimit: -1 }), { a: { 0: 'b' } });
  423. st.deepEqual(qs.parse('a[0]=b', { arrayLimit: 0 }), { a: { 0: 'b' } });
  424. st.deepEqual(qs.parse('a[-1]=b', { arrayLimit: -1 }), { a: { '-1': 'b' } });
  425. st.deepEqual(qs.parse('a[-1]=b', { arrayLimit: 0 }), { a: { '-1': 'b' } });
  426. st.deepEqual(qs.parse('a[0]=b&a[1]=c', { arrayLimit: -1 }), { a: { 0: 'b', 1: 'c' } });
  427. st.deepEqual(qs.parse('a[0]=b&a[1]=c', { arrayLimit: 0 }), { a: { 0: 'b', 1: 'c' } });
  428. st.end();
  429. });
  430. t.test('allows disabling array parsing', function (st) {
  431. var indices = qs.parse('a[0]=b&a[1]=c', { parseArrays: false });
  432. st.deepEqual(indices, { a: { 0: 'b', 1: 'c' } });
  433. st.equal(Array.isArray(indices.a), false, 'parseArrays:false, indices case is not an array');
  434. var emptyBrackets = qs.parse('a[]=b', { parseArrays: false });
  435. st.deepEqual(emptyBrackets, { a: { 0: 'b' } });
  436. st.equal(Array.isArray(emptyBrackets.a), false, 'parseArrays:false, empty brackets case is not an array');
  437. st.end();
  438. });
  439. t.test('allows for query string prefix', function (st) {
  440. st.deepEqual(qs.parse('?foo=bar', { ignoreQueryPrefix: true }), { foo: 'bar' });
  441. st.deepEqual(qs.parse('foo=bar', { ignoreQueryPrefix: true }), { foo: 'bar' });
  442. st.deepEqual(qs.parse('?foo=bar', { ignoreQueryPrefix: false }), { '?foo': 'bar' });
  443. st.end();
  444. });
  445. t.test('parses an object', function (st) {
  446. var input = {
  447. 'user[name]': { 'pop[bob]': 3 },
  448. 'user[email]': null
  449. };
  450. var expected = {
  451. user: {
  452. name: { 'pop[bob]': 3 },
  453. email: null
  454. }
  455. };
  456. var result = qs.parse(input);
  457. st.deepEqual(result, expected);
  458. st.end();
  459. });
  460. t.test('parses string with comma as array divider', function (st) {
  461. st.deepEqual(qs.parse('foo=bar,tee', { comma: true }), { foo: ['bar', 'tee'] });
  462. st.deepEqual(qs.parse('foo[bar]=coffee,tee', { comma: true }), { foo: { bar: ['coffee', 'tee'] } });
  463. st.deepEqual(qs.parse('foo=', { comma: true }), { foo: '' });
  464. st.deepEqual(qs.parse('foo', { comma: true }), { foo: '' });
  465. st.deepEqual(qs.parse('foo', { comma: true, strictNullHandling: true }), { foo: null });
  466. // test cases inversed from from stringify tests
  467. st.deepEqual(qs.parse('a[0]=c'), { a: ['c'] });
  468. st.deepEqual(qs.parse('a[]=c'), { a: ['c'] });
  469. st.deepEqual(qs.parse('a[]=c', { comma: true }), { a: ['c'] });
  470. st.deepEqual(qs.parse('a[0]=c&a[1]=d'), { a: ['c', 'd'] });
  471. st.deepEqual(qs.parse('a[]=c&a[]=d'), { a: ['c', 'd'] });
  472. st.deepEqual(qs.parse('a=c,d', { comma: true }), { a: ['c', 'd'] });
  473. st.end();
  474. });
  475. t.test('parses values with comma as array divider', function (st) {
  476. st.deepEqual(qs.parse({ foo: 'bar,tee' }, { comma: false }), { foo: 'bar,tee' });
  477. st.deepEqual(qs.parse({ foo: 'bar,tee' }, { comma: true }), { foo: ['bar', 'tee'] });
  478. st.end();
  479. });
  480. t.test('use number decoder, parses string that has one number with comma option enabled', function (st) {
  481. var decoder = function (str, defaultDecoder, charset, type) {
  482. if (!isNaN(Number(str))) {
  483. return parseFloat(str);
  484. }
  485. return defaultDecoder(str, defaultDecoder, charset, type);
  486. };
  487. st.deepEqual(qs.parse('foo=1', { comma: true, decoder: decoder }), { foo: 1 });
  488. st.deepEqual(qs.parse('foo=0', { comma: true, decoder: decoder }), { foo: 0 });
  489. st.end();
  490. });
  491. t.test('parses brackets holds array of arrays when having two parts of strings with comma as array divider', function (st) {
  492. st.deepEqual(qs.parse('foo[]=1,2,3&foo[]=4,5,6', { comma: true }), { foo: [['1', '2', '3'], ['4', '5', '6']] });
  493. st.deepEqual(qs.parse('foo[]=1,2,3&foo[]=', { comma: true }), { foo: [['1', '2', '3'], ''] });
  494. st.deepEqual(qs.parse('foo[]=1,2,3&foo[]=,', { comma: true }), { foo: [['1', '2', '3'], ['', '']] });
  495. st.deepEqual(qs.parse('foo[]=1,2,3&foo[]=a', { comma: true }), { foo: [['1', '2', '3'], 'a'] });
  496. st.end();
  497. });
  498. t.test('parses url-encoded brackets holds array of arrays when having two parts of strings with comma as array divider', function (st) {
  499. st.deepEqual(qs.parse('foo%5B%5D=1,2,3&foo%5B%5D=4,5,6', { comma: true }), { foo: [['1', '2', '3'], ['4', '5', '6']] });
  500. st.deepEqual(qs.parse('foo%5B%5D=1,2,3&foo%5B%5D=', { comma: true }), { foo: [['1', '2', '3'], ''] });
  501. st.deepEqual(qs.parse('foo%5B%5D=1,2,3&foo%5B%5D=,', { comma: true }), { foo: [['1', '2', '3'], ['', '']] });
  502. st.deepEqual(qs.parse('foo%5B%5D=1,2,3&foo%5B%5D=a', { comma: true }), { foo: [['1', '2', '3'], 'a'] });
  503. st.end();
  504. });
  505. t.test('parses comma delimited array while having percent-encoded comma treated as normal text', function (st) {
  506. st.deepEqual(qs.parse('foo=a%2Cb', { comma: true }), { foo: 'a,b' });
  507. st.deepEqual(qs.parse('foo=a%2C%20b,d', { comma: true }), { foo: ['a, b', 'd'] });
  508. st.deepEqual(qs.parse('foo=a%2C%20b,c%2C%20d', { comma: true }), { foo: ['a, b', 'c, d'] });
  509. st.end();
  510. });
  511. t.test('parses an object in dot notation', function (st) {
  512. var input = {
  513. 'user.name': { 'pop[bob]': 3 },
  514. 'user.email.': null
  515. };
  516. var expected = {
  517. user: {
  518. name: { 'pop[bob]': 3 },
  519. email: null
  520. }
  521. };
  522. var result = qs.parse(input, { allowDots: true });
  523. st.deepEqual(result, expected);
  524. st.end();
  525. });
  526. t.test('parses an object and not child values', function (st) {
  527. var input = {
  528. 'user[name]': { 'pop[bob]': { test: 3 } },
  529. 'user[email]': null
  530. };
  531. var expected = {
  532. user: {
  533. name: { 'pop[bob]': { test: 3 } },
  534. email: null
  535. }
  536. };
  537. var result = qs.parse(input);
  538. st.deepEqual(result, expected);
  539. st.end();
  540. });
  541. t.test('does not blow up when Buffer global is missing', function (st) {
  542. var restore = mockProperty(global, 'Buffer', { 'delete': true });
  543. var result = qs.parse('a=b&c=d');
  544. restore();
  545. st.deepEqual(result, { a: 'b', c: 'd' });
  546. st.end();
  547. });
  548. t.test('does not crash when parsing circular references', function (st) {
  549. var a = {};
  550. a.b = a;
  551. var parsed;
  552. st.doesNotThrow(function () {
  553. parsed = qs.parse({ 'foo[bar]': 'baz', 'foo[baz]': a });
  554. });
  555. st.equal('foo' in parsed, true, 'parsed has "foo" property');
  556. st.equal('bar' in parsed.foo, true);
  557. st.equal('baz' in parsed.foo, true);
  558. st.equal(parsed.foo.bar, 'baz');
  559. st.deepEqual(parsed.foo.baz, a);
  560. st.end();
  561. });
  562. t.test('does not crash when parsing deep objects', function (st) {
  563. var parsed;
  564. var str = 'foo';
  565. for (var i = 0; i < 5000; i++) {
  566. str += '[p]';
  567. }
  568. str += '=bar';
  569. st.doesNotThrow(function () {
  570. parsed = qs.parse(str, { depth: 5000 });
  571. });
  572. st.equal('foo' in parsed, true, 'parsed has "foo" property');
  573. var depth = 0;
  574. var ref = parsed.foo;
  575. while ((ref = ref.p)) {
  576. depth += 1;
  577. }
  578. st.equal(depth, 5000, 'parsed is 5000 properties deep');
  579. st.end();
  580. });
  581. t.test('parses null objects correctly', { skip: !hasProto }, function (st) {
  582. var a = { __proto__: null, b: 'c' };
  583. st.deepEqual(qs.parse(a), { b: 'c' });
  584. var result = qs.parse({ a: a });
  585. st.equal('a' in result, true, 'result has "a" property');
  586. st.deepEqual(result.a, a);
  587. st.end();
  588. });
  589. t.test('parses dates correctly', function (st) {
  590. var now = new Date();
  591. st.deepEqual(qs.parse({ a: now }), { a: now });
  592. st.end();
  593. });
  594. t.test('parses regular expressions correctly', function (st) {
  595. var re = /^test$/;
  596. st.deepEqual(qs.parse({ a: re }), { a: re });
  597. st.end();
  598. });
  599. t.test('does not allow overwriting prototype properties', function (st) {
  600. st.deepEqual(qs.parse('a[hasOwnProperty]=b', { allowPrototypes: false }), {});
  601. st.deepEqual(qs.parse('hasOwnProperty=b', { allowPrototypes: false }), {});
  602. st.deepEqual(
  603. qs.parse('toString', { allowPrototypes: false }),
  604. {},
  605. 'bare "toString" results in {}'
  606. );
  607. st.end();
  608. });
  609. t.test('can allow overwriting prototype properties', function (st) {
  610. st.deepEqual(qs.parse('a[hasOwnProperty]=b', { allowPrototypes: true }), { a: { hasOwnProperty: 'b' } });
  611. st.deepEqual(qs.parse('hasOwnProperty=b', { allowPrototypes: true }), { hasOwnProperty: 'b' });
  612. st.deepEqual(
  613. qs.parse('toString', { allowPrototypes: true }),
  614. { toString: '' },
  615. 'bare "toString" results in { toString: "" }'
  616. );
  617. st.end();
  618. });
  619. t.test('does not crash when the global Object prototype is frozen', { skip: !hasPropertyDescriptors || !hasOverrideMistake }, function (st) {
  620. // We can't actually freeze the global Object prototype as that will interfere with other tests, and once an object is frozen, it
  621. // can't be unfrozen. Instead, we add a new non-writable property to simulate this.
  622. st.teardown(mockProperty(Object.prototype, 'frozenProp', { value: 'foo', nonWritable: true, nonEnumerable: true }));
  623. st['throws'](
  624. function () {
  625. var obj = {};
  626. obj.frozenProp = 'bar';
  627. },
  628. // node < 6 has a different error message
  629. /^TypeError: Cannot assign to read only property 'frozenProp' of (?:object '#<Object>'|#<Object>)/,
  630. 'regular assignment of an inherited non-writable property throws'
  631. );
  632. var parsed;
  633. st.doesNotThrow(
  634. function () {
  635. parsed = qs.parse('frozenProp', { allowPrototypes: false });
  636. },
  637. 'parsing a nonwritable Object.prototype property does not throw'
  638. );
  639. st.deepEqual(parsed, {}, 'bare "frozenProp" results in {}');
  640. st.end();
  641. });
  642. t.test('params starting with a closing bracket', function (st) {
  643. st.deepEqual(qs.parse(']=toString'), { ']': 'toString' });
  644. st.deepEqual(qs.parse(']]=toString'), { ']]': 'toString' });
  645. st.deepEqual(qs.parse(']hello]=toString'), { ']hello]': 'toString' });
  646. st.end();
  647. });
  648. t.test('params starting with a starting bracket', function (st) {
  649. st.deepEqual(qs.parse('[=toString'), { '[': 'toString' });
  650. st.deepEqual(qs.parse('[[=toString'), { '[[': 'toString' });
  651. st.deepEqual(qs.parse('[hello[=toString'), { '[hello[': 'toString' });
  652. st.end();
  653. });
  654. t.test('add keys to objects', function (st) {
  655. st.deepEqual(
  656. qs.parse('a[b]=c&a=d', { strictMerge: false }),
  657. { a: { b: 'c', d: true } },
  658. 'can add keys to objects'
  659. );
  660. st.deepEqual(
  661. qs.parse('a[b]=c&a=toString', { strictMerge: false }),
  662. { a: { b: 'c' } },
  663. 'can not overwrite prototype'
  664. );
  665. st.deepEqual(
  666. qs.parse('a[b]=c&a=toString', { strictMerge: false, allowPrototypes: true }),
  667. { a: { b: 'c', toString: true } },
  668. 'can overwrite prototype with allowPrototypes true'
  669. );
  670. st.deepEqual(
  671. qs.parse('a[b]=c&a=toString', { strictMerge: false, plainObjects: true }),
  672. { __proto__: null, a: { __proto__: null, b: 'c', toString: true } },
  673. 'can overwrite prototype with plainObjects true'
  674. );
  675. st.end();
  676. });
  677. t.test('strictMerge wraps object and primitive into an array', function (st) {
  678. st.deepEqual(
  679. qs.parse('a[b]=c&a=d'),
  680. { a: [{ b: 'c' }, 'd'] },
  681. 'object then primitive produces array'
  682. );
  683. st.deepEqual(
  684. qs.parse('a=d&a[b]=c'),
  685. { a: ['d', { b: 'c' }] },
  686. 'primitive then object produces array'
  687. );
  688. st.deepEqual(
  689. qs.parse('a[b]=c&a=toString'),
  690. { a: [{ b: 'c' }, 'toString'] },
  691. 'prototype-colliding value is preserved in array'
  692. );
  693. st.deepEqual(
  694. qs.parse('a[b]=c&a=toString', { plainObjects: true }),
  695. { __proto__: null, a: [{ __proto__: null, b: 'c' }, 'toString'] },
  696. 'plainObjects preserved in array wrapping'
  697. );
  698. st.end();
  699. });
  700. t.test('dunder proto is ignored', function (st) {
  701. var payload = 'categories[__proto__]=login&categories[__proto__]&categories[length]=42';
  702. var result = qs.parse(payload, { allowPrototypes: true });
  703. st.deepEqual(
  704. result,
  705. {
  706. categories: {
  707. length: '42'
  708. }
  709. },
  710. 'silent [[Prototype]] payload'
  711. );
  712. var plainResult = qs.parse(payload, { allowPrototypes: true, plainObjects: true });
  713. st.deepEqual(
  714. plainResult,
  715. {
  716. __proto__: null,
  717. categories: {
  718. __proto__: null,
  719. length: '42'
  720. }
  721. },
  722. 'silent [[Prototype]] payload: plain objects'
  723. );
  724. var query = qs.parse('categories[__proto__]=cats&categories[__proto__]=dogs&categories[some][json]=toInject', { allowPrototypes: true });
  725. st.notOk(Array.isArray(query.categories), 'is not an array');
  726. st.notOk(query.categories instanceof Array, 'is not instanceof an array');
  727. st.deepEqual(query.categories, { some: { json: 'toInject' } });
  728. st.equal(JSON.stringify(query.categories), '{"some":{"json":"toInject"}}', 'stringifies as a non-array');
  729. st.deepEqual(
  730. qs.parse('foo[__proto__][hidden]=value&foo[bar]=stuffs', { allowPrototypes: true }),
  731. {
  732. foo: {
  733. bar: 'stuffs'
  734. }
  735. },
  736. 'hidden values'
  737. );
  738. st.deepEqual(
  739. qs.parse('foo[__proto__][hidden]=value&foo[bar]=stuffs', { allowPrototypes: true, plainObjects: true }),
  740. {
  741. __proto__: null,
  742. foo: {
  743. __proto__: null,
  744. bar: 'stuffs'
  745. }
  746. },
  747. 'hidden values: plain objects'
  748. );
  749. st.end();
  750. });
  751. t.test('can return null objects', { skip: !hasProto }, function (st) {
  752. var expected = {
  753. __proto__: null,
  754. a: {
  755. __proto__: null,
  756. b: 'c',
  757. hasOwnProperty: 'd'
  758. }
  759. };
  760. st.deepEqual(qs.parse('a[b]=c&a[hasOwnProperty]=d', { plainObjects: true }), expected);
  761. st.deepEqual(qs.parse(null, { plainObjects: true }), { __proto__: null });
  762. var expectedArray = {
  763. __proto__: null,
  764. a: {
  765. __proto__: null,
  766. 0: 'b',
  767. c: 'd'
  768. }
  769. };
  770. st.deepEqual(qs.parse('a[]=b&a[c]=d', { plainObjects: true }), expectedArray);
  771. st.end();
  772. });
  773. t.test('can parse with custom encoding', function (st) {
  774. st.deepEqual(qs.parse('%8c%a7=%91%e5%8d%e3%95%7b', {
  775. decoder: function (str) {
  776. var reg = /%([0-9A-F]{2})/ig;
  777. var result = [];
  778. var parts = reg.exec(str);
  779. while (parts) {
  780. result.push(parseInt(parts[1], 16));
  781. parts = reg.exec(str);
  782. }
  783. return String(iconv.decode(SaferBuffer.from(result), 'shift_jis'));
  784. }
  785. }), { 県: '大阪府' });
  786. st.end();
  787. });
  788. t.test('receives the default decoder as a second argument', function (st) {
  789. st.plan(1);
  790. qs.parse('a', {
  791. decoder: function (str, defaultDecoder) {
  792. st.equal(defaultDecoder, utils.decode);
  793. }
  794. });
  795. st.end();
  796. });
  797. t.test('throws error with wrong decoder', function (st) {
  798. st['throws'](function () {
  799. qs.parse({}, { decoder: 'string' });
  800. }, new TypeError('Decoder has to be a function.'));
  801. st.end();
  802. });
  803. t.test('does not mutate the options argument', function (st) {
  804. var options = {};
  805. qs.parse('a[b]=true', options);
  806. st.deepEqual(options, {});
  807. st.end();
  808. });
  809. t.test('throws if an invalid charset is specified', function (st) {
  810. st['throws'](function () {
  811. qs.parse('a=b', { charset: 'foobar' });
  812. }, new TypeError('The charset option must be either utf-8, iso-8859-1, or undefined'));
  813. st.end();
  814. });
  815. t.test('parses an iso-8859-1 string if asked to', function (st) {
  816. st.deepEqual(qs.parse('%A2=%BD', { charset: 'iso-8859-1' }), { '¢': '½' });
  817. st.end();
  818. });
  819. var urlEncodedCheckmarkInUtf8 = '%E2%9C%93';
  820. var urlEncodedOSlashInUtf8 = '%C3%B8';
  821. var urlEncodedNumCheckmark = '%26%2310003%3B';
  822. var urlEncodedNumSmiley = '%26%239786%3B';
  823. t.test('prefers an utf-8 charset specified by the utf8 sentinel to a default charset of iso-8859-1', function (st) {
  824. st.deepEqual(qs.parse('utf8=' + urlEncodedCheckmarkInUtf8 + '&' + urlEncodedOSlashInUtf8 + '=' + urlEncodedOSlashInUtf8, { charsetSentinel: true, charset: 'iso-8859-1' }), { ø: 'ø' });
  825. st.end();
  826. });
  827. t.test('prefers an iso-8859-1 charset specified by the utf8 sentinel to a default charset of utf-8', function (st) {
  828. st.deepEqual(qs.parse('utf8=' + urlEncodedNumCheckmark + '&' + urlEncodedOSlashInUtf8 + '=' + urlEncodedOSlashInUtf8, { charsetSentinel: true, charset: 'utf-8' }), { 'ø': 'ø' });
  829. st.end();
  830. });
  831. t.test('does not require the utf8 sentinel to be defined before the parameters whose decoding it affects', function (st) {
  832. st.deepEqual(qs.parse('a=' + urlEncodedOSlashInUtf8 + '&utf8=' + urlEncodedNumCheckmark, { charsetSentinel: true, charset: 'utf-8' }), { a: 'ø' });
  833. st.end();
  834. });
  835. t.test('ignores an utf8 sentinel with an unknown value', function (st) {
  836. st.deepEqual(qs.parse('utf8=foo&' + urlEncodedOSlashInUtf8 + '=' + urlEncodedOSlashInUtf8, { charsetSentinel: true, charset: 'utf-8' }), { ø: 'ø' });
  837. st.end();
  838. });
  839. t.test('uses the utf8 sentinel to switch to utf-8 when no default charset is given', function (st) {
  840. st.deepEqual(qs.parse('utf8=' + urlEncodedCheckmarkInUtf8 + '&' + urlEncodedOSlashInUtf8 + '=' + urlEncodedOSlashInUtf8, { charsetSentinel: true }), { ø: 'ø' });
  841. st.end();
  842. });
  843. t.test('uses the utf8 sentinel to switch to iso-8859-1 when no default charset is given', function (st) {
  844. st.deepEqual(qs.parse('utf8=' + urlEncodedNumCheckmark + '&' + urlEncodedOSlashInUtf8 + '=' + urlEncodedOSlashInUtf8, { charsetSentinel: true }), { 'ø': 'ø' });
  845. st.end();
  846. });
  847. t.test('interprets numeric entities in iso-8859-1 when `interpretNumericEntities`', function (st) {
  848. st.deepEqual(qs.parse('foo=' + urlEncodedNumSmiley, { charset: 'iso-8859-1', interpretNumericEntities: true }), { foo: '☺' });
  849. st.end();
  850. });
  851. t.test('handles a custom decoder returning `null`, in the `iso-8859-1` charset, when `interpretNumericEntities`', function (st) {
  852. st.deepEqual(qs.parse('foo=&bar=' + urlEncodedNumSmiley, {
  853. charset: 'iso-8859-1',
  854. decoder: function (str, defaultDecoder, charset) {
  855. return str ? defaultDecoder(str, defaultDecoder, charset) : null;
  856. },
  857. interpretNumericEntities: true
  858. }), { foo: null, bar: '☺' });
  859. st.end();
  860. });
  861. t.test('handles a custom decoder returning `null`, with a string key of `null`', function (st) {
  862. st.deepEqual(
  863. qs.parse('null=1&ToNull=2', {
  864. decoder: function (str, defaultDecoder, charset) {
  865. return str === 'ToNull' ? null : defaultDecoder(str, defaultDecoder, charset);
  866. }
  867. }),
  868. { 'null': '1' },
  869. '"null" key is not overridden by `null` decoder result'
  870. );
  871. st.end();
  872. });
  873. t.test('does not interpret numeric entities in iso-8859-1 when `interpretNumericEntities` is absent', function (st) {
  874. st.deepEqual(qs.parse('foo=' + urlEncodedNumSmiley, { charset: 'iso-8859-1' }), { foo: '&#9786;' });
  875. st.end();
  876. });
  877. t.test('does not interpret numeric entities when the charset is utf-8, even when `interpretNumericEntities`', function (st) {
  878. st.deepEqual(qs.parse('foo=' + urlEncodedNumSmiley, { charset: 'utf-8', interpretNumericEntities: true }), { foo: '&#9786;' });
  879. st.end();
  880. });
  881. t.test('interpretNumericEntities with comma:true and iso charset does not crash', function (st) {
  882. st.deepEqual(
  883. qs.parse('b&a[]=1,' + urlEncodedNumSmiley, { comma: true, charset: 'iso-8859-1', interpretNumericEntities: true }),
  884. { b: '', a: ['1,☺'] }
  885. );
  886. st.end();
  887. });
  888. t.test('does not interpret %uXXXX syntax in iso-8859-1 mode', function (st) {
  889. st.deepEqual(qs.parse('%u263A=%u263A', { charset: 'iso-8859-1' }), { '%u263A': '%u263A' });
  890. st.end();
  891. });
  892. t.test('allows for decoding keys and values differently', function (st) {
  893. var decoder = function (str, defaultDecoder, charset, type) {
  894. if (type === 'key') {
  895. return defaultDecoder(str, defaultDecoder, charset, type).toLowerCase();
  896. }
  897. if (type === 'value') {
  898. return defaultDecoder(str, defaultDecoder, charset, type).toUpperCase();
  899. }
  900. throw 'this should never happen! type: ' + type;
  901. };
  902. st.deepEqual(qs.parse('KeY=vAlUe', { decoder: decoder }), { key: 'VALUE' });
  903. var noopDecoder = function () { return 'x'; };
  904. noopDecoder();
  905. st['throws'](
  906. function () { decoder('x', noopDecoder, 'utf-8', 'unknown'); },
  907. 'this should never happen! type: unknown',
  908. 'decoder throws for unexpected type'
  909. );
  910. st.end();
  911. });
  912. t.test('parameter limit tests', function (st) {
  913. st.test('does not throw error when within parameter limit', function (sst) {
  914. var result = qs.parse('a=1&b=2&c=3', { parameterLimit: 5, throwOnLimitExceeded: true });
  915. sst.deepEqual(result, { a: '1', b: '2', c: '3' }, 'parses without errors');
  916. sst.end();
  917. });
  918. st.test('throws error when throwOnLimitExceeded is present but not boolean', function (sst) {
  919. sst['throws'](
  920. function () {
  921. qs.parse('a=1&b=2&c=3&d=4&e=5&f=6', { parameterLimit: 3, throwOnLimitExceeded: 'true' });
  922. },
  923. new TypeError('`throwOnLimitExceeded` option must be a boolean'),
  924. 'throws error when throwOnLimitExceeded is present and not boolean'
  925. );
  926. sst.end();
  927. });
  928. st.test('throws error when parameter limit exceeded', function (sst) {
  929. sst['throws'](
  930. function () {
  931. qs.parse('a=1&b=2&c=3&d=4&e=5&f=6', { parameterLimit: 3, throwOnLimitExceeded: true });
  932. },
  933. new RangeError('Parameter limit exceeded. Only 3 parameters allowed.'),
  934. 'throws error when parameter limit is exceeded'
  935. );
  936. sst['throws'](
  937. function () {
  938. qs.parse('a=1&b=2', { parameterLimit: 1, throwOnLimitExceeded: true });
  939. },
  940. new RangeError('Parameter limit exceeded. Only 1 parameter allowed.'),
  941. 'throws error with singular "parameter" when parameterLimit is 1'
  942. );
  943. sst.end();
  944. });
  945. st.test('silently truncates when throwOnLimitExceeded is not given', function (sst) {
  946. var result = qs.parse('a=1&b=2&c=3&d=4&e=5', { parameterLimit: 3 });
  947. sst.deepEqual(result, { a: '1', b: '2', c: '3' }, 'parses and truncates silently');
  948. sst.end();
  949. });
  950. st.test('silently truncates when parameter limit exceeded without error', function (sst) {
  951. var result = qs.parse('a=1&b=2&c=3&d=4&e=5', { parameterLimit: 3, throwOnLimitExceeded: false });
  952. sst.deepEqual(result, { a: '1', b: '2', c: '3' }, 'parses and truncates silently');
  953. sst.end();
  954. });
  955. st.test('allows unlimited parameters when parameterLimit set to Infinity', function (sst) {
  956. var result = qs.parse('a=1&b=2&c=3&d=4&e=5&f=6', { parameterLimit: Infinity });
  957. sst.deepEqual(result, { a: '1', b: '2', c: '3', d: '4', e: '5', f: '6' }, 'parses all parameters without truncation');
  958. sst.end();
  959. });
  960. st.test('allows unlimited parameters when parameterLimit is Infinity and throwOnLimitExceeded is true', function (sst) {
  961. var result = qs.parse('a=1&b=2&c=3&d=4&e=5&f=6', { parameterLimit: Infinity, throwOnLimitExceeded: true });
  962. sst.deepEqual(result, { a: '1', b: '2', c: '3', d: '4', e: '5', f: '6' }, 'parses all parameters without truncation or throwing');
  963. sst.end();
  964. });
  965. st.end();
  966. });
  967. t.test('array limit tests', function (st) {
  968. st.test('does not throw error when array is within limit', function (sst) {
  969. var result = qs.parse('a[]=1&a[]=2&a[]=3', { arrayLimit: 5, throwOnLimitExceeded: true });
  970. sst.deepEqual(result, { a: ['1', '2', '3'] }, 'parses array without errors');
  971. sst.end();
  972. });
  973. st.test('throws error when throwOnLimitExceeded is present but not boolean for array limit', function (sst) {
  974. sst['throws'](
  975. function () {
  976. qs.parse('a[]=1&a[]=2&a[]=3&a[]=4', { arrayLimit: 3, throwOnLimitExceeded: 'true' });
  977. },
  978. new TypeError('`throwOnLimitExceeded` option must be a boolean'),
  979. 'throws error when throwOnLimitExceeded is present and not boolean for array limit'
  980. );
  981. sst.end();
  982. });
  983. st.test('throws error when array limit exceeded', function (sst) {
  984. // 4 elements exceeds limit of 3
  985. sst['throws'](
  986. function () {
  987. qs.parse('a[]=1&a[]=2&a[]=3&a[]=4', { arrayLimit: 3, throwOnLimitExceeded: true });
  988. },
  989. new RangeError('Array limit exceeded. Only 3 elements allowed in an array.'),
  990. 'throws error when array limit is exceeded'
  991. );
  992. sst.end();
  993. });
  994. st.test('does not throw when at limit', function (sst) {
  995. // 3 elements = limit of 3, should not throw
  996. var result = qs.parse('a[]=1&a[]=2&a[]=3', { arrayLimit: 3, throwOnLimitExceeded: true });
  997. sst.ok(Array.isArray(result.a), 'result is an array');
  998. sst.deepEqual(result.a, ['1', '2', '3'], 'all values present');
  999. sst.end();
  1000. });
  1001. st.test('converts array to object if length is greater than limit', function (sst) {
  1002. var result = qs.parse('a[1]=1&a[2]=2&a[3]=3&a[4]=4&a[5]=5&a[6]=6', { arrayLimit: 5 });
  1003. sst.deepEqual(result, { a: { 1: '1', 2: '2', 3: '3', 4: '4', 5: '5', 6: '6' } }, 'parses into object if array length is greater than limit');
  1004. sst.end();
  1005. });
  1006. st.test('throws error when indexed notation exceeds arrayLimit with throwOnLimitExceeded', function (sst) {
  1007. sst['throws'](
  1008. function () {
  1009. qs.parse('a[1001]=b', { arrayLimit: 1000, throwOnLimitExceeded: true });
  1010. },
  1011. new RangeError('Array limit exceeded. Only 1000 elements allowed in an array.'),
  1012. 'throws error for a single index exceeding arrayLimit'
  1013. );
  1014. sst['throws'](
  1015. function () {
  1016. qs.parse('a[0]=1&a[1]=2&a[2]=3&a[10]=4', { arrayLimit: 6, throwOnLimitExceeded: true, allowSparse: true });
  1017. },
  1018. new RangeError('Array limit exceeded. Only 6 elements allowed in an array.'),
  1019. 'throws error when a sparse index exceeds arrayLimit'
  1020. );
  1021. sst['throws'](
  1022. function () {
  1023. qs.parse('a[2]=b', { arrayLimit: 1, throwOnLimitExceeded: true });
  1024. },
  1025. new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
  1026. 'throws error with singular "element" when arrayLimit is 1'
  1027. );
  1028. sst.end();
  1029. });
  1030. st.test('does not throw for indexed notation within arrayLimit with throwOnLimitExceeded', function (sst) {
  1031. var result = qs.parse('a[4]=b', { arrayLimit: 5, throwOnLimitExceeded: true, allowSparse: true });
  1032. sst.ok(Array.isArray(result.a), 'result is an array');
  1033. sst.equal(result.a.length, 5, 'array has correct length');
  1034. sst.equal(result.a[4], 'b', 'value at index 4 is correct');
  1035. sst.end();
  1036. });
  1037. st.test('silently converts to object for indexed notation exceeding arrayLimit without throwOnLimitExceeded', function (sst) {
  1038. var result = qs.parse('a[1001]=b', { arrayLimit: 1000 });
  1039. sst.deepEqual(result, { a: { 1001: 'b' } }, 'converts to object without throwing');
  1040. sst.end();
  1041. });
  1042. st.test('throws when duplicate bracket keys exceed arrayLimit with throwOnLimitExceeded', function (sst) {
  1043. sst['throws'](
  1044. function () {
  1045. qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5, throwOnLimitExceeded: true });
  1046. },
  1047. new RangeError('Array limit exceeded. Only 5 elements allowed in an array.'),
  1048. 'throws error when duplicate bracket notation exceeds array limit'
  1049. );
  1050. sst.end();
  1051. });
  1052. st.end();
  1053. });
  1054. t.end();
  1055. });
  1056. test('parses empty keys', function (t) {
  1057. emptyTestCases.forEach(function (testCase) {
  1058. t.test('skips empty string key with ' + testCase.input, function (st) {
  1059. st.deepEqual(qs.parse(testCase.input), testCase.noEmptyKeys);
  1060. st.end();
  1061. });
  1062. });
  1063. });
  1064. test('`duplicates` option', function (t) {
  1065. v.nonStrings.concat('not a valid option').forEach(function (invalidOption) {
  1066. if (typeof invalidOption !== 'undefined') {
  1067. t['throws'](
  1068. function () { qs.parse('', { duplicates: invalidOption }); },
  1069. TypeError,
  1070. 'throws on invalid option: ' + inspect(invalidOption)
  1071. );
  1072. }
  1073. });
  1074. t.deepEqual(
  1075. qs.parse('foo=bar&foo=baz'),
  1076. { foo: ['bar', 'baz'] },
  1077. 'duplicates: default, combine'
  1078. );
  1079. t.deepEqual(
  1080. qs.parse('foo=bar&foo=baz', { duplicates: 'combine' }),
  1081. { foo: ['bar', 'baz'] },
  1082. 'duplicates: combine'
  1083. );
  1084. t.deepEqual(
  1085. qs.parse('foo=bar&foo=baz', { duplicates: 'first' }),
  1086. { foo: 'bar' },
  1087. 'duplicates: first'
  1088. );
  1089. t.deepEqual(
  1090. qs.parse('foo=bar&foo=baz', { duplicates: 'last' }),
  1091. { foo: 'baz' },
  1092. 'duplicates: last'
  1093. );
  1094. t.test('bracket notation always combines regardless of duplicates', function (st) {
  1095. st.deepEqual(
  1096. qs.parse('a=1&a=2&b[]=1&b[]=2', { duplicates: 'last' }),
  1097. { a: '2', b: ['1', '2'] },
  1098. 'duplicates last: unbracketed takes last, bracketed combines'
  1099. );
  1100. st.deepEqual(
  1101. qs.parse('b[]=1&b[]=2', { duplicates: 'last' }),
  1102. { b: ['1', '2'] },
  1103. 'duplicates last: bracketed always combines'
  1104. );
  1105. st.deepEqual(
  1106. qs.parse('b[]=1&b[]=2', { duplicates: 'first' }),
  1107. { b: ['1', '2'] },
  1108. 'duplicates first: bracketed always combines'
  1109. );
  1110. st.deepEqual(
  1111. qs.parse('a=1&a=2&b[]=1&b[]=2', { duplicates: 'first' }),
  1112. { a: '1', b: ['1', '2'] },
  1113. 'duplicates first: unbracketed takes first, bracketed combines'
  1114. );
  1115. st.end();
  1116. });
  1117. t.end();
  1118. });
  1119. test('qs strictDepth option - throw cases', function (t) {
  1120. t.test('throws an exception when depth exceeds the limit with strictDepth: true', function (st) {
  1121. st['throws'](
  1122. function () {
  1123. qs.parse('a[b][c][d][e][f][g][h][i]=j', { depth: 1, strictDepth: true });
  1124. },
  1125. RangeError,
  1126. 'throws RangeError'
  1127. );
  1128. st.end();
  1129. });
  1130. t.test('throws an exception for multiple nested arrays with strictDepth: true', function (st) {
  1131. st['throws'](
  1132. function () {
  1133. qs.parse('a[0][1][2][3][4]=b', { depth: 3, strictDepth: true });
  1134. },
  1135. RangeError,
  1136. 'throws RangeError'
  1137. );
  1138. st.end();
  1139. });
  1140. t.test('throws an exception for nested objects and arrays with strictDepth: true', function (st) {
  1141. st['throws'](
  1142. function () {
  1143. qs.parse('a[b][c][0][d][e]=f', { depth: 3, strictDepth: true });
  1144. },
  1145. RangeError,
  1146. 'throws RangeError'
  1147. );
  1148. st.end();
  1149. });
  1150. t.test('throws an exception for different types of values with strictDepth: true', function (st) {
  1151. st['throws'](
  1152. function () {
  1153. qs.parse('a[b][c][d][e]=true&a[b][c][d][f]=42', { depth: 3, strictDepth: true });
  1154. },
  1155. RangeError,
  1156. 'throws RangeError'
  1157. );
  1158. st.end();
  1159. });
  1160. });
  1161. test('qs strictDepth option - non-throw cases', function (t) {
  1162. t.test('when depth is 0 and strictDepth true, do not throw', function (st) {
  1163. st.doesNotThrow(
  1164. function () {
  1165. qs.parse('a[b][c][d][e]=true&a[b][c][d][f]=42', { depth: 0, strictDepth: true });
  1166. },
  1167. RangeError,
  1168. 'does not throw RangeError'
  1169. );
  1170. st.end();
  1171. });
  1172. t.test('parses successfully when depth is within the limit with strictDepth: true', function (st) {
  1173. st.doesNotThrow(
  1174. function () {
  1175. var result = qs.parse('a[b]=c', { depth: 1, strictDepth: true });
  1176. st.deepEqual(result, { a: { b: 'c' } }, 'parses correctly');
  1177. }
  1178. );
  1179. st.end();
  1180. });
  1181. t.test('does not throw an exception when depth exceeds the limit with strictDepth: false', function (st) {
  1182. st.doesNotThrow(
  1183. function () {
  1184. var result = qs.parse('a[b][c][d][e][f][g][h][i]=j', { depth: 1 });
  1185. st.deepEqual(result, { a: { b: { '[c][d][e][f][g][h][i]': 'j' } } }, 'parses with depth limit');
  1186. }
  1187. );
  1188. st.end();
  1189. });
  1190. t.test('parses successfully when depth is within the limit with strictDepth: false', function (st) {
  1191. st.doesNotThrow(
  1192. function () {
  1193. var result = qs.parse('a[b]=c', { depth: 1 });
  1194. st.deepEqual(result, { a: { b: 'c' } }, 'parses correctly');
  1195. }
  1196. );
  1197. st.end();
  1198. });
  1199. t.test('does not throw when depth is exactly at the limit with strictDepth: true', function (st) {
  1200. st.doesNotThrow(
  1201. function () {
  1202. var result = qs.parse('a[b][c]=d', { depth: 2, strictDepth: true });
  1203. st.deepEqual(result, { a: { b: { c: 'd' } } }, 'parses correctly');
  1204. }
  1205. );
  1206. st.end();
  1207. });
  1208. });
  1209. test('DOS', function (t) {
  1210. var arr = [];
  1211. for (var i = 0; i < 105; i++) {
  1212. arr[arr.length] = 'x';
  1213. }
  1214. var attack = 'a[]=' + arr.join('&a[]=');
  1215. var result = qs.parse(attack, { arrayLimit: 100 });
  1216. t.notOk(Array.isArray(result.a), 'arrayLimit is respected: result is an object, not an array');
  1217. t.equal(Object.keys(result.a).length, 105, 'all values are preserved');
  1218. t.end();
  1219. });
  1220. test('arrayLimit boundary conditions', function (t) {
  1221. // arrayLimit is the max number of elements allowed in an array
  1222. t.test('exactly at the limit stays as array', function (st) {
  1223. // 3 elements = limit of 3
  1224. var result = qs.parse('a[]=1&a[]=2&a[]=3', { arrayLimit: 3 });
  1225. st.ok(Array.isArray(result.a), 'result is an array when count equals limit');
  1226. st.deepEqual(result.a, ['1', '2', '3'], 'all values present');
  1227. st.end();
  1228. });
  1229. t.test('one over the limit converts to object', function (st) {
  1230. // 4 elements exceeds limit of 3
  1231. var result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4', { arrayLimit: 3 });
  1232. st.notOk(Array.isArray(result.a), 'result is not an array when over limit');
  1233. st.deepEqual(result.a, { 0: '1', 1: '2', 2: '3', 3: '4' }, 'all values preserved as object');
  1234. st.end();
  1235. });
  1236. t.test('arrayLimit 1 with one value', function (st) {
  1237. // 1 element = limit of 1
  1238. var result = qs.parse('a[]=1', { arrayLimit: 1 });
  1239. st.ok(Array.isArray(result.a), 'result is an array when count equals limit');
  1240. st.deepEqual(result.a, ['1'], 'value preserved as array');
  1241. st.end();
  1242. });
  1243. t.test('arrayLimit 1 with two values converts to object', function (st) {
  1244. // 2 elements exceeds limit of 1
  1245. var result = qs.parse('a[]=1&a[]=2', { arrayLimit: 1 });
  1246. st.notOk(Array.isArray(result.a), 'result is not an array');
  1247. st.deepEqual(result.a, { 0: '1', 1: '2' }, 'all values preserved as object');
  1248. st.end();
  1249. });
  1250. t.end();
  1251. });
  1252. test('comma + arrayLimit', function (t) {
  1253. t.test('comma-separated values within arrayLimit stay as array', function (st) {
  1254. var result = qs.parse('a=1,2,3', { comma: true, arrayLimit: 5 });
  1255. st.ok(Array.isArray(result.a), 'result is an array');
  1256. st.deepEqual(result.a, ['1', '2', '3'], 'all values present');
  1257. st.end();
  1258. });
  1259. t.test('comma-separated values exceeding arrayLimit convert to object', function (st) {
  1260. var result = qs.parse('a=1,2,3,4', { comma: true, arrayLimit: 3 });
  1261. st.notOk(Array.isArray(result.a), 'result is not an array when over limit');
  1262. st.deepEqual(result.a, { 0: '1', 1: '2', 2: '3', 3: '4' }, 'all values preserved as object');
  1263. st.end();
  1264. });
  1265. t.test('comma-separated values exceeding arrayLimit with throwOnLimitExceeded throws', function (st) {
  1266. st['throws'](
  1267. function () {
  1268. qs.parse('a=1,2,3,4', { comma: true, arrayLimit: 3, throwOnLimitExceeded: true });
  1269. },
  1270. new RangeError('Array limit exceeded. Only 3 elements allowed in an array.'),
  1271. 'throws error when comma-split exceeds array limit'
  1272. );
  1273. st['throws'](
  1274. function () {
  1275. qs.parse('a=1,2,3', { comma: true, arrayLimit: 1, throwOnLimitExceeded: true });
  1276. },
  1277. new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
  1278. 'throws error with singular "element" when arrayLimit is 1'
  1279. );
  1280. st.end();
  1281. });
  1282. t.test('comma-separated values at exactly arrayLimit stay as array', function (st) {
  1283. var result = qs.parse('a=1,2,3', { comma: true, arrayLimit: 3 });
  1284. st.ok(Array.isArray(result.a), 'result is an array when exactly at limit');
  1285. st.deepEqual(result.a, ['1', '2', '3'], 'all values present');
  1286. st.end();
  1287. });
  1288. t.end();
  1289. });
  1290. test('mixed array and object notation', function (t) {
  1291. t.test('array brackets with object key - under limit', function (st) {
  1292. st.deepEqual(
  1293. qs.parse('a[]=b&a[c]=d'),
  1294. { a: { 0: 'b', c: 'd' } },
  1295. 'mixing [] and [key] converts to object'
  1296. );
  1297. st.end();
  1298. });
  1299. t.test('array index with object key - under limit', function (st) {
  1300. st.deepEqual(
  1301. qs.parse('a[0]=b&a[c]=d'),
  1302. { a: { 0: 'b', c: 'd' } },
  1303. 'mixing [0] and [key] produces object'
  1304. );
  1305. st.end();
  1306. });
  1307. t.test('plain value with array brackets - under limit', function (st) {
  1308. st.deepEqual(
  1309. qs.parse('a=b&a[]=c', { arrayLimit: 20 }),
  1310. { a: ['b', 'c'] },
  1311. 'plain value combined with [] stays as array under limit'
  1312. );
  1313. st.end();
  1314. });
  1315. t.test('array brackets with plain value - under limit', function (st) {
  1316. st.deepEqual(
  1317. qs.parse('a[]=b&a=c', { arrayLimit: 20 }),
  1318. { a: ['b', 'c'] },
  1319. '[] combined with plain value stays as array under limit'
  1320. );
  1321. st.end();
  1322. });
  1323. t.test('plain value with array index - under limit', function (st) {
  1324. st.deepEqual(
  1325. qs.parse('a=b&a[0]=c', { arrayLimit: 20 }),
  1326. { a: ['b', 'c'] },
  1327. 'plain value combined with [0] stays as array under limit'
  1328. );
  1329. st.end();
  1330. });
  1331. t.test('multiple plain values with duplicates combine', function (st) {
  1332. st.deepEqual(
  1333. qs.parse('a=b&a=c&a=d', { arrayLimit: 20 }),
  1334. { a: ['b', 'c', 'd'] },
  1335. 'duplicate plain keys combine into array'
  1336. );
  1337. st.end();
  1338. });
  1339. t.test('multiple plain values exceeding limit', function (st) {
  1340. // 3 elements (indices 0-2), max index 2 > limit 1
  1341. st.deepEqual(
  1342. qs.parse('a=b&a=c&a=d', { arrayLimit: 1 }),
  1343. { a: { 0: 'b', 1: 'c', 2: 'd' } },
  1344. 'duplicate plain keys convert to object when exceeding limit'
  1345. );
  1346. st.end();
  1347. });
  1348. t.test('mixed notation produces consistent results when arrayLimit is exceeded', function (st) {
  1349. var expected = { a: { 0: 'b', 1: 'c', 2: 'd' } };
  1350. st.deepEqual(
  1351. qs.parse('a[]=b&a[1]=c&a=d', { arrayLimit: -1 }),
  1352. expected,
  1353. 'arrayLimit -1'
  1354. );
  1355. st.deepEqual(
  1356. qs.parse('a[]=b&a[1]=c&a=d', { arrayLimit: 0 }),
  1357. expected,
  1358. 'arrayLimit 0'
  1359. );
  1360. st.deepEqual(
  1361. qs.parse('a[]=b&a[1]=c&a=d', { arrayLimit: 1 }),
  1362. expected,
  1363. 'arrayLimit 1'
  1364. );
  1365. st.end();
  1366. });
  1367. t.test('uses existing array length for currentArrayLength when parsing object input with bracket keys', function (st) {
  1368. var input = {};
  1369. var arr = ['x', 'y'];
  1370. arr.a = ['z', 'w'];
  1371. input['a[]'] = arr;
  1372. st.deepEqual(qs.parse(input), { a: ['x', 'y'] }, 'parses object input with bracket keys using existing array values');
  1373. st.end();
  1374. });
  1375. t.test('throws with singular message when object input bracket key exceeds arrayLimit of 1', function (st) {
  1376. var input = {};
  1377. var arr = ['x'];
  1378. arr.a = ['z', 'w'];
  1379. input['a[]'] = arr;
  1380. st['throws'](
  1381. function () {
  1382. qs.parse(input, { throwOnLimitExceeded: true, arrayLimit: 1 });
  1383. },
  1384. new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
  1385. 'throws singular error for object input exceeding arrayLimit 1'
  1386. );
  1387. st.end();
  1388. });
  1389. t.end();
  1390. });