You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

676 lines
27 KiB

4 years ago
  1. 'use strict';
  2. var test = require('tape');
  3. var qs = require('../');
  4. var utils = require('../lib/utils');
  5. var iconv = require('iconv-lite');
  6. var SaferBuffer = require('safer-buffer').Buffer;
  7. test('parse()', function (t) {
  8. t.test('parses a simple string', function (st) {
  9. st.deepEqual(qs.parse('0=foo'), { 0: 'foo' });
  10. st.deepEqual(qs.parse('foo=c++'), { foo: 'c ' });
  11. st.deepEqual(qs.parse('a[>=]=23'), { a: { '>=': '23' } });
  12. st.deepEqual(qs.parse('a[<=>]==23'), { a: { '<=>': '=23' } });
  13. st.deepEqual(qs.parse('a[==]=23'), { a: { '==': '23' } });
  14. st.deepEqual(qs.parse('foo', { strictNullHandling: true }), { foo: null });
  15. st.deepEqual(qs.parse('foo'), { foo: '' });
  16. st.deepEqual(qs.parse('foo='), { foo: '' });
  17. st.deepEqual(qs.parse('foo=bar'), { foo: 'bar' });
  18. st.deepEqual(qs.parse(' foo = bar = baz '), { ' foo ': ' bar = baz ' });
  19. st.deepEqual(qs.parse('foo=bar=baz'), { foo: 'bar=baz' });
  20. st.deepEqual(qs.parse('foo=bar&bar=baz'), { foo: 'bar', bar: 'baz' });
  21. st.deepEqual(qs.parse('foo2=bar2&baz2='), { foo2: 'bar2', baz2: '' });
  22. st.deepEqual(qs.parse('foo=bar&baz', { strictNullHandling: true }), { foo: 'bar', baz: null });
  23. st.deepEqual(qs.parse('foo=bar&baz'), { foo: 'bar', baz: '' });
  24. st.deepEqual(qs.parse('cht=p3&chd=t:60,40&chs=250x100&chl=Hello|World'), {
  25. cht: 'p3',
  26. chd: 't:60,40',
  27. chs: '250x100',
  28. chl: 'Hello|World'
  29. });
  30. st.end();
  31. });
  32. t.test('allows enabling dot notation', function (st) {
  33. st.deepEqual(qs.parse('a.b=c'), { 'a.b': 'c' });
  34. st.deepEqual(qs.parse('a.b=c', { allowDots: true }), { a: { b: 'c' } });
  35. st.end();
  36. });
  37. t.deepEqual(qs.parse('a[b]=c'), { a: { b: 'c' } }, 'parses a single nested string');
  38. t.deepEqual(qs.parse('a[b][c]=d'), { a: { b: { c: 'd' } } }, 'parses a double nested string');
  39. t.deepEqual(
  40. qs.parse('a[b][c][d][e][f][g][h]=i'),
  41. { a: { b: { c: { d: { e: { f: { '[g][h]': 'i' } } } } } } },
  42. 'defaults to a depth of 5'
  43. );
  44. t.test('only parses one level when depth = 1', function (st) {
  45. st.deepEqual(qs.parse('a[b][c]=d', { depth: 1 }), { a: { b: { '[c]': 'd' } } });
  46. st.deepEqual(qs.parse('a[b][c][d]=e', { depth: 1 }), { a: { b: { '[c][d]': 'e' } } });
  47. st.end();
  48. });
  49. t.deepEqual(qs.parse('a=b&a=c'), { a: ['b', 'c'] }, 'parses a simple array');
  50. t.test('parses an explicit array', function (st) {
  51. st.deepEqual(qs.parse('a[]=b'), { a: ['b'] });
  52. st.deepEqual(qs.parse('a[]=b&a[]=c'), { a: ['b', 'c'] });
  53. st.deepEqual(qs.parse('a[]=b&a[]=c&a[]=d'), { a: ['b', 'c', 'd'] });
  54. st.end();
  55. });
  56. t.test('parses a mix of simple and explicit arrays', function (st) {
  57. st.deepEqual(qs.parse('a=b&a[]=c'), { a: ['b', 'c'] });
  58. st.deepEqual(qs.parse('a[]=b&a=c'), { a: ['b', 'c'] });
  59. st.deepEqual(qs.parse('a[0]=b&a=c'), { a: ['b', 'c'] });
  60. st.deepEqual(qs.parse('a=b&a[0]=c'), { a: ['b', 'c'] });
  61. st.deepEqual(qs.parse('a[1]=b&a=c', { arrayLimit: 20 }), { a: ['b', 'c'] });
  62. st.deepEqual(qs.parse('a[]=b&a=c', { arrayLimit: 0 }), { a: ['b', 'c'] });
  63. st.deepEqual(qs.parse('a[]=b&a=c'), { a: ['b', 'c'] });
  64. st.deepEqual(qs.parse('a=b&a[1]=c', { arrayLimit: 20 }), { a: ['b', 'c'] });
  65. st.deepEqual(qs.parse('a=b&a[]=c', { arrayLimit: 0 }), { a: ['b', 'c'] });
  66. st.deepEqual(qs.parse('a=b&a[]=c'), { a: ['b', 'c'] });
  67. st.end();
  68. });
  69. t.test('parses a nested array', function (st) {
  70. st.deepEqual(qs.parse('a[b][]=c&a[b][]=d'), { a: { b: ['c', 'd'] } });
  71. st.deepEqual(qs.parse('a[>=]=25'), { a: { '>=': '25' } });
  72. st.end();
  73. });
  74. t.test('allows to specify array indices', function (st) {
  75. st.deepEqual(qs.parse('a[1]=c&a[0]=b&a[2]=d'), { a: ['b', 'c', 'd'] });
  76. st.deepEqual(qs.parse('a[1]=c&a[0]=b'), { a: ['b', 'c'] });
  77. st.deepEqual(qs.parse('a[1]=c', { arrayLimit: 20 }), { a: ['c'] });
  78. st.deepEqual(qs.parse('a[1]=c', { arrayLimit: 0 }), { a: { 1: 'c' } });
  79. st.deepEqual(qs.parse('a[1]=c'), { a: ['c'] });
  80. st.end();
  81. });
  82. t.test('limits specific array indices to arrayLimit', function (st) {
  83. st.deepEqual(qs.parse('a[20]=a', { arrayLimit: 20 }), { a: ['a'] });
  84. st.deepEqual(qs.parse('a[21]=a', { arrayLimit: 20 }), { a: { 21: 'a' } });
  85. st.end();
  86. });
  87. t.deepEqual(qs.parse('a[12b]=c'), { a: { '12b': 'c' } }, 'supports keys that begin with a number');
  88. t.test('supports encoded = signs', function (st) {
  89. st.deepEqual(qs.parse('he%3Dllo=th%3Dere'), { 'he=llo': 'th=ere' });
  90. st.end();
  91. });
  92. t.test('is ok with url encoded strings', function (st) {
  93. st.deepEqual(qs.parse('a[b%20c]=d'), { a: { 'b c': 'd' } });
  94. st.deepEqual(qs.parse('a[b]=c%20d'), { a: { b: 'c d' } });
  95. st.end();
  96. });
  97. t.test('allows brackets in the value', function (st) {
  98. st.deepEqual(qs.parse('pets=["tobi"]'), { pets: '["tobi"]' });
  99. st.deepEqual(qs.parse('operators=[">=", "<="]'), { operators: '[">=", "<="]' });
  100. st.end();
  101. });
  102. t.test('allows empty values', function (st) {
  103. st.deepEqual(qs.parse(''), {});
  104. st.deepEqual(qs.parse(null), {});
  105. st.deepEqual(qs.parse(undefined), {});
  106. st.end();
  107. });
  108. t.test('transforms arrays to objects', function (st) {
  109. st.deepEqual(qs.parse('foo[0]=bar&foo[bad]=baz'), { foo: { 0: 'bar', bad: 'baz' } });
  110. st.deepEqual(qs.parse('foo[bad]=baz&foo[0]=bar'), { foo: { bad: 'baz', 0: 'bar' } });
  111. st.deepEqual(qs.parse('foo[bad]=baz&foo[]=bar'), { foo: { bad: 'baz', 0: 'bar' } });
  112. st.deepEqual(qs.parse('foo[]=bar&foo[bad]=baz'), { foo: { 0: 'bar', bad: 'baz' } });
  113. st.deepEqual(qs.parse('foo[bad]=baz&foo[]=bar&foo[]=foo'), { foo: { bad: 'baz', 0: 'bar', 1: 'foo' } });
  114. st.deepEqual(qs.parse('foo[0][a]=a&foo[0][b]=b&foo[1][a]=aa&foo[1][b]=bb'), { foo: [{ a: 'a', b: 'b' }, { a: 'aa', b: 'bb' }] });
  115. st.deepEqual(qs.parse('a[]=b&a[t]=u&a[hasOwnProperty]=c', { allowPrototypes: false }), { a: { 0: 'b', t: 'u' } });
  116. st.deepEqual(qs.parse('a[]=b&a[t]=u&a[hasOwnProperty]=c', { allowPrototypes: true }), { a: { 0: 'b', t: 'u', hasOwnProperty: 'c' } });
  117. st.deepEqual(qs.parse('a[]=b&a[hasOwnProperty]=c&a[x]=y', { allowPrototypes: false }), { a: { 0: 'b', x: 'y' } });
  118. st.deepEqual(qs.parse('a[]=b&a[hasOwnProperty]=c&a[x]=y', { allowPrototypes: true }), { a: { 0: 'b', hasOwnProperty: 'c', x: 'y' } });
  119. st.end();
  120. });
  121. t.test('transforms arrays to objects (dot notation)', function (st) {
  122. st.deepEqual(qs.parse('foo[0].baz=bar&fool.bad=baz', { allowDots: true }), { foo: [{ baz: 'bar' }], fool: { bad: 'baz' } });
  123. st.deepEqual(qs.parse('foo[0].baz=bar&fool.bad.boo=baz', { allowDots: true }), { foo: [{ baz: 'bar' }], fool: { bad: { boo: 'baz' } } });
  124. st.deepEqual(qs.parse('foo[0][0].baz=bar&fool.bad=baz', { allowDots: true }), { foo: [[{ baz: 'bar' }]], fool: { bad: 'baz' } });
  125. st.deepEqual(qs.parse('foo[0].baz[0]=15&foo[0].bar=2', { allowDots: true }), { foo: [{ baz: ['15'], bar: '2' }] });
  126. st.deepEqual(qs.parse('foo[0].baz[0]=15&foo[0].baz[1]=16&foo[0].bar=2', { allowDots: true }), { foo: [{ baz: ['15', '16'], bar: '2' }] });
  127. st.deepEqual(qs.parse('foo.bad=baz&foo[0]=bar', { allowDots: true }), { foo: { bad: 'baz', 0: 'bar' } });
  128. st.deepEqual(qs.parse('foo.bad=baz&foo[]=bar', { allowDots: true }), { foo: { bad: 'baz', 0: 'bar' } });
  129. st.deepEqual(qs.parse('foo[]=bar&foo.bad=baz', { allowDots: true }), { foo: { 0: 'bar', bad: 'baz' } });
  130. st.deepEqual(qs.parse('foo.bad=baz&foo[]=bar&foo[]=foo', { allowDots: true }), { foo: { bad: 'baz', 0: 'bar', 1: 'foo' } });
  131. st.deepEqual(qs.parse('foo[0].a=a&foo[0].b=b&foo[1].a=aa&foo[1].b=bb', { allowDots: true }), { foo: [{ a: 'a', b: 'b' }, { a: 'aa', b: 'bb' }] });
  132. st.end();
  133. });
  134. t.test('correctly prunes undefined values when converting an array to an object', function (st) {
  135. st.deepEqual(qs.parse('a[2]=b&a[99999999]=c'), { a: { 2: 'b', 99999999: 'c' } });
  136. st.end();
  137. });
  138. t.test('supports malformed uri characters', function (st) {
  139. st.deepEqual(qs.parse('{%:%}', { strictNullHandling: true }), { '{%:%}': null });
  140. st.deepEqual(qs.parse('{%:%}='), { '{%:%}': '' });
  141. st.deepEqual(qs.parse('foo=%:%}'), { foo: '%:%}' });
  142. st.end();
  143. });
  144. t.test('doesn\'t produce empty keys', function (st) {
  145. st.deepEqual(qs.parse('_r=1&'), { _r: '1' });
  146. st.end();
  147. });
  148. t.test('cannot access Object prototype', function (st) {
  149. qs.parse('constructor[prototype][bad]=bad');
  150. qs.parse('bad[constructor][prototype][bad]=bad');
  151. st.equal(typeof Object.prototype.bad, 'undefined');
  152. st.end();
  153. });
  154. t.test('parses arrays of objects', function (st) {
  155. st.deepEqual(qs.parse('a[][b]=c'), { a: [{ b: 'c' }] });
  156. st.deepEqual(qs.parse('a[0][b]=c'), { a: [{ b: 'c' }] });
  157. st.end();
  158. });
  159. t.test('allows for empty strings in arrays', function (st) {
  160. st.deepEqual(qs.parse('a[]=b&a[]=&a[]=c'), { a: ['b', '', 'c'] });
  161. st.deepEqual(
  162. qs.parse('a[0]=b&a[1]&a[2]=c&a[19]=', { strictNullHandling: true, arrayLimit: 20 }),
  163. { a: ['b', null, 'c', ''] },
  164. 'with arrayLimit 20 + array indices: null then empty string works'
  165. );
  166. st.deepEqual(
  167. qs.parse('a[]=b&a[]&a[]=c&a[]=', { strictNullHandling: true, arrayLimit: 0 }),
  168. { a: ['b', null, 'c', ''] },
  169. 'with arrayLimit 0 + array brackets: null then empty string works'
  170. );
  171. st.deepEqual(
  172. qs.parse('a[0]=b&a[1]=&a[2]=c&a[19]', { strictNullHandling: true, arrayLimit: 20 }),
  173. { a: ['b', '', 'c', null] },
  174. 'with arrayLimit 20 + array indices: empty string then null works'
  175. );
  176. st.deepEqual(
  177. qs.parse('a[]=b&a[]=&a[]=c&a[]', { strictNullHandling: true, arrayLimit: 0 }),
  178. { a: ['b', '', 'c', null] },
  179. 'with arrayLimit 0 + array brackets: empty string then null works'
  180. );
  181. st.deepEqual(
  182. qs.parse('a[]=&a[]=b&a[]=c'),
  183. { a: ['', 'b', 'c'] },
  184. 'array brackets: empty strings work'
  185. );
  186. st.end();
  187. });
  188. t.test('compacts sparse arrays', function (st) {
  189. st.deepEqual(qs.parse('a[10]=1&a[2]=2', { arrayLimit: 20 }), { a: ['2', '1'] });
  190. st.deepEqual(qs.parse('a[1][b][2][c]=1', { arrayLimit: 20 }), { a: [{ b: [{ c: '1' }] }] });
  191. st.deepEqual(qs.parse('a[1][2][3][c]=1', { arrayLimit: 20 }), { a: [[[{ c: '1' }]]] });
  192. st.deepEqual(qs.parse('a[1][2][3][c][1]=1', { arrayLimit: 20 }), { a: [[[{ c: ['1'] }]]] });
  193. st.end();
  194. });
  195. t.test('parses semi-parsed strings', function (st) {
  196. st.deepEqual(qs.parse({ 'a[b]': 'c' }), { a: { b: 'c' } });
  197. st.deepEqual(qs.parse({ 'a[b]': 'c', 'a[d]': 'e' }), { a: { b: 'c', d: 'e' } });
  198. st.end();
  199. });
  200. t.test('parses buffers correctly', function (st) {
  201. var b = SaferBuffer.from('test');
  202. st.deepEqual(qs.parse({ a: b }), { a: b });
  203. st.end();
  204. });
  205. t.test('parses jquery-param strings', function (st) {
  206. // readable = 'filter[0][]=int1&filter[0][]==&filter[0][]=77&filter[]=and&filter[2][]=int2&filter[2][]==&filter[2][]=8'
  207. var encoded = 'filter%5B0%5D%5B%5D=int1&filter%5B0%5D%5B%5D=%3D&filter%5B0%5D%5B%5D=77&filter%5B%5D=and&filter%5B2%5D%5B%5D=int2&filter%5B2%5D%5B%5D=%3D&filter%5B2%5D%5B%5D=8';
  208. var expected = { filter: [['int1', '=', '77'], 'and', ['int2', '=', '8']] };
  209. st.deepEqual(qs.parse(encoded), expected);
  210. st.end();
  211. });
  212. t.test('continues parsing when no parent is found', function (st) {
  213. st.deepEqual(qs.parse('[]=&a=b'), { 0: '', a: 'b' });
  214. st.deepEqual(qs.parse('[]&a=b', { strictNullHandling: true }), { 0: null, a: 'b' });
  215. st.deepEqual(qs.parse('[foo]=bar'), { foo: 'bar' });
  216. st.end();
  217. });
  218. t.test('does not error when parsing a very long array', function (st) {
  219. var str = 'a[]=a';
  220. while (Buffer.byteLength(str) < 128 * 1024) {
  221. str = str + '&' + str;
  222. }
  223. st.doesNotThrow(function () {
  224. qs.parse(str);
  225. });
  226. st.end();
  227. });
  228. t.test('should not throw when a native prototype has an enumerable property', function (st) {
  229. Object.prototype.crash = '';
  230. Array.prototype.crash = '';
  231. st.doesNotThrow(qs.parse.bind(null, 'a=b'));
  232. st.deepEqual(qs.parse('a=b'), { a: 'b' });
  233. st.doesNotThrow(qs.parse.bind(null, 'a[][b]=c'));
  234. st.deepEqual(qs.parse('a[][b]=c'), { a: [{ b: 'c' }] });
  235. delete Object.prototype.crash;
  236. delete Array.prototype.crash;
  237. st.end();
  238. });
  239. t.test('parses a string with an alternative string delimiter', function (st) {
  240. st.deepEqual(qs.parse('a=b;c=d', { delimiter: ';' }), { a: 'b', c: 'd' });
  241. st.end();
  242. });
  243. t.test('parses a string with an alternative RegExp delimiter', function (st) {
  244. st.deepEqual(qs.parse('a=b; c=d', { delimiter: /[;,] */ }), { a: 'b', c: 'd' });
  245. st.end();
  246. });
  247. t.test('does not use non-splittable objects as delimiters', function (st) {
  248. st.deepEqual(qs.parse('a=b&c=d', { delimiter: true }), { a: 'b', c: 'd' });
  249. st.end();
  250. });
  251. t.test('allows overriding parameter limit', function (st) {
  252. st.deepEqual(qs.parse('a=b&c=d', { parameterLimit: 1 }), { a: 'b' });
  253. st.end();
  254. });
  255. t.test('allows setting the parameter limit to Infinity', function (st) {
  256. st.deepEqual(qs.parse('a=b&c=d', { parameterLimit: Infinity }), { a: 'b', c: 'd' });
  257. st.end();
  258. });
  259. t.test('allows overriding array limit', function (st) {
  260. st.deepEqual(qs.parse('a[0]=b', { arrayLimit: -1 }), { a: { 0: 'b' } });
  261. st.deepEqual(qs.parse('a[-1]=b', { arrayLimit: -1 }), { a: { '-1': 'b' } });
  262. st.deepEqual(qs.parse('a[0]=b&a[1]=c', { arrayLimit: 0 }), { a: { 0: 'b', 1: 'c' } });
  263. st.end();
  264. });
  265. t.test('allows disabling array parsing', function (st) {
  266. var indices = qs.parse('a[0]=b&a[1]=c', { parseArrays: false });
  267. st.deepEqual(indices, { a: { 0: 'b', 1: 'c' } });
  268. st.equal(Array.isArray(indices.a), false, 'parseArrays:false, indices case is not an array');
  269. var emptyBrackets = qs.parse('a[]=b', { parseArrays: false });
  270. st.deepEqual(emptyBrackets, { a: { 0: 'b' } });
  271. st.equal(Array.isArray(emptyBrackets.a), false, 'parseArrays:false, empty brackets case is not an array');
  272. st.end();
  273. });
  274. t.test('allows for query string prefix', function (st) {
  275. st.deepEqual(qs.parse('?foo=bar', { ignoreQueryPrefix: true }), { foo: 'bar' });
  276. st.deepEqual(qs.parse('foo=bar', { ignoreQueryPrefix: true }), { foo: 'bar' });
  277. st.deepEqual(qs.parse('?foo=bar', { ignoreQueryPrefix: false }), { '?foo': 'bar' });
  278. st.end();
  279. });
  280. t.test('parses an object', function (st) {
  281. var input = {
  282. 'user[name]': { 'pop[bob]': 3 },
  283. 'user[email]': null
  284. };
  285. var expected = {
  286. user: {
  287. name: { 'pop[bob]': 3 },
  288. email: null
  289. }
  290. };
  291. var result = qs.parse(input);
  292. st.deepEqual(result, expected);
  293. st.end();
  294. });
  295. t.test('parses string with comma as array divider', function (st) {
  296. st.deepEqual(qs.parse('foo=bar,tee', { comma: true }), { foo: ['bar', 'tee'] });
  297. st.deepEqual(qs.parse('foo[bar]=coffee,tee', { comma: true }), { foo: { bar: ['coffee', 'tee'] } });
  298. st.deepEqual(qs.parse('foo=', { comma: true }), { foo: '' });
  299. st.deepEqual(qs.parse('foo', { comma: true }), { foo: '' });
  300. st.deepEqual(qs.parse('foo', { comma: true, strictNullHandling: true }), { foo: null });
  301. st.end();
  302. });
  303. t.test('parses an object in dot notation', function (st) {
  304. var input = {
  305. 'user.name': { 'pop[bob]': 3 },
  306. 'user.email.': null
  307. };
  308. var expected = {
  309. user: {
  310. name: { 'pop[bob]': 3 },
  311. email: null
  312. }
  313. };
  314. var result = qs.parse(input, { allowDots: true });
  315. st.deepEqual(result, expected);
  316. st.end();
  317. });
  318. t.test('parses an object and not child values', function (st) {
  319. var input = {
  320. 'user[name]': { 'pop[bob]': { test: 3 } },
  321. 'user[email]': null
  322. };
  323. var expected = {
  324. user: {
  325. name: { 'pop[bob]': { test: 3 } },
  326. email: null
  327. }
  328. };
  329. var result = qs.parse(input);
  330. st.deepEqual(result, expected);
  331. st.end();
  332. });
  333. t.test('does not blow up when Buffer global is missing', function (st) {
  334. var tempBuffer = global.Buffer;
  335. delete global.Buffer;
  336. var result = qs.parse('a=b&c=d');
  337. global.Buffer = tempBuffer;
  338. st.deepEqual(result, { a: 'b', c: 'd' });
  339. st.end();
  340. });
  341. t.test('does not crash when parsing circular references', function (st) {
  342. var a = {};
  343. a.b = a;
  344. var parsed;
  345. st.doesNotThrow(function () {
  346. parsed = qs.parse({ 'foo[bar]': 'baz', 'foo[baz]': a });
  347. });
  348. st.equal('foo' in parsed, true, 'parsed has "foo" property');
  349. st.equal('bar' in parsed.foo, true);
  350. st.equal('baz' in parsed.foo, true);
  351. st.equal(parsed.foo.bar, 'baz');
  352. st.deepEqual(parsed.foo.baz, a);
  353. st.end();
  354. });
  355. t.test('does not crash when parsing deep objects', function (st) {
  356. var parsed;
  357. var str = 'foo';
  358. for (var i = 0; i < 5000; i++) {
  359. str += '[p]';
  360. }
  361. str += '=bar';
  362. st.doesNotThrow(function () {
  363. parsed = qs.parse(str, { depth: 5000 });
  364. });
  365. st.equal('foo' in parsed, true, 'parsed has "foo" property');
  366. var depth = 0;
  367. var ref = parsed.foo;
  368. while ((ref = ref.p)) {
  369. depth += 1;
  370. }
  371. st.equal(depth, 5000, 'parsed is 5000 properties deep');
  372. st.end();
  373. });
  374. t.test('parses null objects correctly', { skip: !Object.create }, function (st) {
  375. var a = Object.create(null);
  376. a.b = 'c';
  377. st.deepEqual(qs.parse(a), { b: 'c' });
  378. var result = qs.parse({ a: a });
  379. st.equal('a' in result, true, 'result has "a" property');
  380. st.deepEqual(result.a, a);
  381. st.end();
  382. });
  383. t.test('parses dates correctly', function (st) {
  384. var now = new Date();
  385. st.deepEqual(qs.parse({ a: now }), { a: now });
  386. st.end();
  387. });
  388. t.test('parses regular expressions correctly', function (st) {
  389. var re = /^test$/;
  390. st.deepEqual(qs.parse({ a: re }), { a: re });
  391. st.end();
  392. });
  393. t.test('does not allow overwriting prototype properties', function (st) {
  394. st.deepEqual(qs.parse('a[hasOwnProperty]=b', { allowPrototypes: false }), {});
  395. st.deepEqual(qs.parse('hasOwnProperty=b', { allowPrototypes: false }), {});
  396. st.deepEqual(
  397. qs.parse('toString', { allowPrototypes: false }),
  398. {},
  399. 'bare "toString" results in {}'
  400. );
  401. st.end();
  402. });
  403. t.test('can allow overwriting prototype properties', function (st) {
  404. st.deepEqual(qs.parse('a[hasOwnProperty]=b', { allowPrototypes: true }), { a: { hasOwnProperty: 'b' } });
  405. st.deepEqual(qs.parse('hasOwnProperty=b', { allowPrototypes: true }), { hasOwnProperty: 'b' });
  406. st.deepEqual(
  407. qs.parse('toString', { allowPrototypes: true }),
  408. { toString: '' },
  409. 'bare "toString" results in { toString: "" }'
  410. );
  411. st.end();
  412. });
  413. t.test('params starting with a closing bracket', function (st) {
  414. st.deepEqual(qs.parse(']=toString'), { ']': 'toString' });
  415. st.deepEqual(qs.parse(']]=toString'), { ']]': 'toString' });
  416. st.deepEqual(qs.parse(']hello]=toString'), { ']hello]': 'toString' });
  417. st.end();
  418. });
  419. t.test('params starting with a starting bracket', function (st) {
  420. st.deepEqual(qs.parse('[=toString'), { '[': 'toString' });
  421. st.deepEqual(qs.parse('[[=toString'), { '[[': 'toString' });
  422. st.deepEqual(qs.parse('[hello[=toString'), { '[hello[': 'toString' });
  423. st.end();
  424. });
  425. t.test('add keys to objects', function (st) {
  426. st.deepEqual(
  427. qs.parse('a[b]=c&a=d'),
  428. { a: { b: 'c', d: true } },
  429. 'can add keys to objects'
  430. );
  431. st.deepEqual(
  432. qs.parse('a[b]=c&a=toString'),
  433. { a: { b: 'c' } },
  434. 'can not overwrite prototype'
  435. );
  436. st.deepEqual(
  437. qs.parse('a[b]=c&a=toString', { allowPrototypes: true }),
  438. { a: { b: 'c', toString: true } },
  439. 'can overwrite prototype with allowPrototypes true'
  440. );
  441. st.deepEqual(
  442. qs.parse('a[b]=c&a=toString', { plainObjects: true }),
  443. { a: { b: 'c', toString: true } },
  444. 'can overwrite prototype with plainObjects true'
  445. );
  446. st.end();
  447. });
  448. t.test('can return null objects', { skip: !Object.create }, function (st) {
  449. var expected = Object.create(null);
  450. expected.a = Object.create(null);
  451. expected.a.b = 'c';
  452. expected.a.hasOwnProperty = 'd';
  453. st.deepEqual(qs.parse('a[b]=c&a[hasOwnProperty]=d', { plainObjects: true }), expected);
  454. st.deepEqual(qs.parse(null, { plainObjects: true }), Object.create(null));
  455. var expectedArray = Object.create(null);
  456. expectedArray.a = Object.create(null);
  457. expectedArray.a[0] = 'b';
  458. expectedArray.a.c = 'd';
  459. st.deepEqual(qs.parse('a[]=b&a[c]=d', { plainObjects: true }), expectedArray);
  460. st.end();
  461. });
  462. t.test('can parse with custom encoding', function (st) {
  463. st.deepEqual(qs.parse('%8c%a7=%91%e5%8d%e3%95%7b', {
  464. decoder: function (str) {
  465. var reg = /%([0-9A-F]{2})/ig;
  466. var result = [];
  467. var parts = reg.exec(str);
  468. while (parts) {
  469. result.push(parseInt(parts[1], 16));
  470. parts = reg.exec(str);
  471. }
  472. return String(iconv.decode(SaferBuffer.from(result), 'shift_jis'));
  473. }
  474. }), { : '大阪府' });
  475. st.end();
  476. });
  477. t.test('receives the default decoder as a second argument', function (st) {
  478. st.plan(1);
  479. qs.parse('a', {
  480. decoder: function (str, defaultDecoder) {
  481. st.equal(defaultDecoder, utils.decode);
  482. }
  483. });
  484. st.end();
  485. });
  486. t.test('throws error with wrong decoder', function (st) {
  487. st['throws'](function () {
  488. qs.parse({}, { decoder: 'string' });
  489. }, new TypeError('Decoder has to be a function.'));
  490. st.end();
  491. });
  492. t.test('does not mutate the options argument', function (st) {
  493. var options = {};
  494. qs.parse('a[b]=true', options);
  495. st.deepEqual(options, {});
  496. st.end();
  497. });
  498. t.test('throws if an invalid charset is specified', function (st) {
  499. st['throws'](function () {
  500. qs.parse('a=b', { charset: 'foobar' });
  501. }, new TypeError('The charset option must be either utf-8, iso-8859-1, or undefined'));
  502. st.end();
  503. });
  504. t.test('parses an iso-8859-1 string if asked to', function (st) {
  505. st.deepEqual(qs.parse('%A2=%BD', { charset: 'iso-8859-1' }), { '¢': '½' });
  506. st.end();
  507. });
  508. var urlEncodedCheckmarkInUtf8 = '%E2%9C%93';
  509. var urlEncodedOSlashInUtf8 = '%C3%B8';
  510. var urlEncodedNumCheckmark = '%26%2310003%3B';
  511. var urlEncodedNumSmiley = '%26%239786%3B';
  512. t.test('prefers an utf-8 charset specified by the utf8 sentinel to a default charset of iso-8859-1', function (st) {
  513. st.deepEqual(qs.parse('utf8=' + urlEncodedCheckmarkInUtf8 + '&' + urlEncodedOSlashInUtf8 + '=' + urlEncodedOSlashInUtf8, { charsetSentinel: true, charset: 'iso-8859-1' }), { ø: 'ø' });
  514. st.end();
  515. });
  516. t.test('prefers an iso-8859-1 charset specified by the utf8 sentinel to a default charset of utf-8', function (st) {
  517. st.deepEqual(qs.parse('utf8=' + urlEncodedNumCheckmark + '&' + urlEncodedOSlashInUtf8 + '=' + urlEncodedOSlashInUtf8, { charsetSentinel: true, charset: 'utf-8' }), { 'ø': 'ø' });
  518. st.end();
  519. });
  520. t.test('does not require the utf8 sentinel to be defined before the parameters whose decoding it affects', function (st) {
  521. st.deepEqual(qs.parse('a=' + urlEncodedOSlashInUtf8 + '&utf8=' + urlEncodedNumCheckmark, { charsetSentinel: true, charset: 'utf-8' }), { a: 'ø' });
  522. st.end();
  523. });
  524. t.test('should ignore an utf8 sentinel with an unknown value', function (st) {
  525. st.deepEqual(qs.parse('utf8=foo&' + urlEncodedOSlashInUtf8 + '=' + urlEncodedOSlashInUtf8, { charsetSentinel: true, charset: 'utf-8' }), { ø: 'ø' });
  526. st.end();
  527. });
  528. t.test('uses the utf8 sentinel to switch to utf-8 when no default charset is given', function (st) {
  529. st.deepEqual(qs.parse('utf8=' + urlEncodedCheckmarkInUtf8 + '&' + urlEncodedOSlashInUtf8 + '=' + urlEncodedOSlashInUtf8, { charsetSentinel: true }), { ø: 'ø' });
  530. st.end();
  531. });
  532. t.test('uses the utf8 sentinel to switch to iso-8859-1 when no default charset is given', function (st) {
  533. st.deepEqual(qs.parse('utf8=' + urlEncodedNumCheckmark + '&' + urlEncodedOSlashInUtf8 + '=' + urlEncodedOSlashInUtf8, { charsetSentinel: true }), { 'ø': 'ø' });
  534. st.end();
  535. });
  536. t.test('interprets numeric entities in iso-8859-1 when `interpretNumericEntities`', function (st) {
  537. st.deepEqual(qs.parse('foo=' + urlEncodedNumSmiley, { charset: 'iso-8859-1', interpretNumericEntities: true }), { foo: '☺' });
  538. st.end();
  539. });
  540. t.test('handles a custom decoder returning `null`, in the `iso-8859-1` charset, when `interpretNumericEntities`', function (st) {
  541. st.deepEqual(qs.parse('foo=&bar=' + urlEncodedNumSmiley, {
  542. charset: 'iso-8859-1',
  543. decoder: function (str, defaultDecoder, charset) {
  544. return str ? defaultDecoder(str, defaultDecoder, charset) : null;
  545. },
  546. interpretNumericEntities: true
  547. }), { foo: null, bar: '☺' });
  548. st.end();
  549. });
  550. t.test('does not interpret numeric entities in iso-8859-1 when `interpretNumericEntities` is absent', function (st) {
  551. st.deepEqual(qs.parse('foo=' + urlEncodedNumSmiley, { charset: 'iso-8859-1' }), { foo: '&#9786;' });
  552. st.end();
  553. });
  554. t.test('does not interpret numeric entities when the charset is utf-8, even when `interpretNumericEntities`', function (st) {
  555. st.deepEqual(qs.parse('foo=' + urlEncodedNumSmiley, { charset: 'utf-8', interpretNumericEntities: true }), { foo: '&#9786;' });
  556. st.end();
  557. });
  558. t.test('does not interpret %uXXXX syntax in iso-8859-1 mode', function (st) {
  559. st.deepEqual(qs.parse('%u263A=%u263A', { charset: 'iso-8859-1' }), { '%u263A': '%u263A' });
  560. st.end();
  561. });
  562. t.end();
  563. });