Socket
Socket
Sign inDemoInstall

koa-qs

Package Overview
Dependencies
16
Maintainers
10
Versions
5
Alerts
File Explorer

Advanced tools

Install Socket

Detect and block malicious and high-risk dependencies

Install

    koa-qs

qs for koa


Version published
Maintainers
10
Install size
170 kB
Created

Readme

Source

Koa Querystring

NPM version build status Test coverage David deps node version npm download

By default, Koa uses the native querystring module which does not provide nesting support. This patches a koa app with nesting support via the qs support, which is also used by Connect and Express.

Simply wrap a koa app with this module:

// Koa 1.x.x
const koa = require('koa')
const app = koa()
require('koa-qs')(app)
// Koa 2.x.x
const Koa = require('koa')
const app = new Koa()
require('koa-qs')(app)

Optional parse mode

There're three parse mode.

extended mode

The default mode, use [qs] module.

require('koa-qs')(app, 'extended')

simple mode

Use querystring module, same as koa does by default. If you want to use this mode, don't use this module.

strict mode

This mode make this.query.foo return strict array.

require('koa-qs')(app, 'strict')
What's different

A normal request GET /foo?p=a&q=foo&q=bar.

  • before patch
console.log('%j', this.query);
{
  "p": "a",
  "q": ["foo", "bar"]
}
  • after patch
console.log('%j', this.query);
{
  "p": ["a"],
  "q": ["foo", "bar"]
}

first mode

This mode make this.query.foo return strict string. Disable multi values.

If querystring contains multi same name params, return the first item.

require('koa-qs')(app, 'first')

In 95% use cases, application only want string query params.

This patch can avoid some stupid TypeError and some security issues like MongoDB inject when the developers forget handling query params type check.

What's different

A normal request GET /foo?p=a,b&p=b,c.

  • before patch
console.log('%j', this.query.p);
["a,b", "b,c"]
  • after patch
console.log('%j', this.query.p);
"a,b"

License

MIT

FAQs

Last updated on 27 May 2020

Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc