can-deparam - npm Package Compare versions

Comparing version 1.0.0 to 1.0.1

can-deparam-test.js

@@ -39,2 +39,8 @@ var deparam = require('./can-deparam');
 });
+test('Invalid encoding', function() {
+	var data = deparam('foo=%0g');
+	deepEqual(data, {
+		foo: '%0g'
+	});
+});
 /** /
@@ -41,0 +47,0 @@ test("deparam an array", function(){

can-deparam.js

@@ -24,4 +24,14 @@ var namespace = require("can-namespace");
 	paramTest = /([^?#]*)(#.*)?$/,
+	entityRegex = /%([^0-9a-f][0-9a-f]|[0-9a-f][^0-9a-f]|[^0-9a-f][^0-9a-f])/i,
 	prep = function (str) {
-		return decodeURIComponent(str.replace(/\+/g, ' '));
+		str = str.replace(/\+/g, ' ');
+
+		try {
+			return decodeURIComponent(str);
+		}
+		catch (e) {
+			return decodeURIComponent(str.replace(entityRegex, function(match, hex) {
+				return '%25' + hex;
+			}));
+		}
 	};
@@ -28,0 +38,0 @@ module.exports = namespace.deparam = function (params) {

dist/amd/can-deparam.js

@@ -1,6 +0,13 @@
-/*can-deparam@0.0.0#can-deparam*/
+/*can-deparam@1.0.0#can-deparam*/
 define(function (require, exports, module) {
     var namespace = require('can-namespace');
-    var digitTest = /^\d+$/, keyBreaker = /([^\[\]]+)|(\[\])/g, paramTest = /([^?#]*)(#.*)?$/, prep = function (str) {
-            return decodeURIComponent(str.replace(/\+/g, ' '));
+    var digitTest = /^\d+$/, keyBreaker = /([^\[\]]+)|(\[\])/g, paramTest = /([^?#]*)(#.*)?$/, entityRegex = /%([^0-9a-f][0-9a-f]|[0-9a-f][^0-9a-f]|[^0-9a-f][^0-9a-f])/i, prep = function (str) {
+            str = str.replace(/\+/g, ' ');
+            try {
+                return decodeURIComponent(str);
+            } catch (e) {
+                return decodeURIComponent(str.replace(entityRegex, function (match, hex) {
+                    return '%25' + hex;
+                }));
+            }
         };
@@ -7,0 +14,0 @@ module.exports = namespace.deparam = function (params) {

dist/cjs/can-deparam.js

@@ -1,5 +0,12 @@
-/*can-deparam@0.0.0#can-deparam*/
+/*can-deparam@1.0.0#can-deparam*/
 var namespace = require('can-namespace');
-var digitTest = /^\d+$/, keyBreaker = /([^\[\]]+)|(\[\])/g, paramTest = /([^?#]*)(#.*)?$/, prep = function (str) {
-        return decodeURIComponent(str.replace(/\+/g, ' '));
+var digitTest = /^\d+$/, keyBreaker = /([^\[\]]+)|(\[\])/g, paramTest = /([^?#]*)(#.*)?$/, entityRegex = /%([^0-9a-f][0-9a-f]|[0-9a-f][^0-9a-f]|[^0-9a-f][^0-9a-f])/i, prep = function (str) {
+        str = str.replace(/\+/g, ' ');
+        try {
+            return decodeURIComponent(str);
+        } catch (e) {
+            return decodeURIComponent(str.replace(entityRegex, function (match, hex) {
+                return '%25' + hex;
+            }));
+        }
     };
@@ -6,0 +13,0 @@ module.exports = namespace.deparam = function (params) {

dist/global/can-deparam.js

@@ -110,7 +110,14 @@ /*[global-shim-start]*/
 )
-/*can-deparam@0.0.0#can-deparam*/
+/*can-deparam@1.0.0#can-deparam*/
 define('can-deparam', function (require, exports, module) {
     var namespace = require('can-namespace');
-    var digitTest = /^\d+$/, keyBreaker = /([^\[\]]+)|(\[\])/g, paramTest = /([^?#]*)(#.*)?$/, prep = function (str) {
-            return decodeURIComponent(str.replace(/\+/g, ' '));
+    var digitTest = /^\d+$/, keyBreaker = /([^\[\]]+)|(\[\])/g, paramTest = /([^?#]*)(#.*)?$/, entityRegex = /%([^0-9a-f][0-9a-f]|[0-9a-f][^0-9a-f]|[^0-9a-f][^0-9a-f])/i, prep = function (str) {
+            str = str.replace(/\+/g, ' ');
+            try {
+                return decodeURIComponent(str);
+            } catch (e) {
+                return decodeURIComponent(str.replace(entityRegex, function (match, hex) {
+                    return '%25' + hex;
+                }));
+            }
         };
@@ -117,0 +124,0 @@ module.exports = namespace.deparam = function (params) {

package.json

 {
   "name": "can-deparam",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Deserialize a query string into an array or object.",
@@ -5,0 +5,0 @@ "homepage": "https://canjs.com/",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

19655

increased by6.81%

Lines of code

363

increased by11.01%

Worsened metrics

Number of medium supply chain risk alerts

2

increased by100%

No dependency changes