
Security News
Open Source CAI Framework Handles Pen Testing Tasks up to 3,600Ć Faster Than Humans
CAI is a new open source AI framework that automates penetration testing tasks like scanning and exploitation up to 3,600Ć faster than humans.
A lightweight query string parser/stringifier with support for nesting and some configurability.
Built on top of fast-querystring.
npm i -S picoquery
2.x
and above are ESM only (i.e. your project will need type: "module"
in the package.json
).
If you cannot yet move to ESM, you may continue to use 1.x
which will still
receive non-breaking changes, backported from main
.
Parsing a query string:
import {parse} from 'picoquery';
parse('foo.bar=abc&baz=def');
/*
{
foo: {
bar: 'abc'
},
baz: 'def'
}
*/
Stringifying an object:
import {stringify} from 'picoquery';
stringify({
foo: {
bar: 123
}
});
/*
foo.bar=123
*/
stringify(object[, options])
Converts the given object into a query string, optionally with configured options.
parse(str[, options])
Parses the given query string into an object, optionally with configured options.
The default options are as follows:
{
nesting: true,
nestingSyntax: 'dot',
arrayRepeat: false,
arrayRepeatSyntax: 'repeat',
delimiter: '&'
}
nesting
When true, nested objects are supported.
For example, when parsing:
parse('foo.bar=baz', {nesting: true});
// {foo: {bar: 'baz'}}
When stringifying:
stringify({foo: {bar: 'baz'}}, {nesting: true});
// foo.bar=baz
This also results in arrays being supported:
parse('foo.0=bar', {nesting: true});
// {foo: ['bar']}
stringify({foo: ['bar']}, {nesting: true});
// foo.0=bar
nestingSyntax
Sets which style of nesting syntax should be used. The choices are:
dot
(e.g. foo.bar=baz
)index
(e.g. foo[bar]=baz
)js
(e.g. foo.bar[0]=baz
, i.e. arrays are indexed and properties are
dotted)arrayRepeat
If true
, this will treat repeated keys as arrays.
For example:
parse('foo=x&foo=y', {arrayRepeat: true});
// {foo: ['x', 'y']}
stringify({foo: ['x', 'y']}, {arrayRepeat: true});
// foo=x&foo=y
arrayRepeatSyntax
Sets which style of array repetition syntax should be used. The choices are:
bracket
(e.g. foo[]=x&foo[]=y
)repeat
(e.g. foo=x&foo=y
)delimiter
Sets the delimiter to be used instead of &
.
For example:
parse('foo=x;bar=y', {delimiter: ';'});
// {foo: 'x', bar: 'y'}
stringify({foo: 'x', bar: 'y'}, {delimiter: ';'});
// foo=x;bar=y
valueDeserializer
Can be set to a function which will be used to deserialize each value during parsing.
It will be called with the value
and the already deserialized
key
(i.e. (value: string, key: PropertyKey) => *
).
For example:
parse('foo=300', {
valueDeserializer: (value) => {
const asNum = Number(value);
return Number.isNaN(asNum) ? value : asNum;
}
});
// {foo: 300}
keyDeserializer
Can be set to a function which will be used to deserialize each key during parsing.
It will be called with the key
from the query string
(i.e. (key) => PropertyKey
).
For example:
parse('300=foo', {
keyDeserializer: (key) => {
const asNum = Number(key);
return Number.isNaN(asNum) ? key : asNum;
}
});
// {300: 'foo'}
shouldSerializeObject
Can be set to a function which determines if an object-like value should be serialized instead of being treated as a nested object.
All non-object primitives will always be serialized.
For example:
// Assuming `StringifableObject` returns its constructor value when `toString`
// is called.
stringify({
foo: new StringifiableObject('test')
}, {
shouldSerializeObject(val) {
return val instanceof StringifableObject;
},
valueSerializer: (value) => {
return String(value);
}
});
// foo=test
If you want to fall back to the default logic, you can import the default function:
import {defaultShouldSerializeObject, stringify} from 'picoquery';
stringify({
foo: new StringifiableObject('test')
}, {
shouldSerializeObject(val) {
if (val instanceof StringifableObject) {
return true;
}
return defaultShouldSerializeObject(val);
}
});
valueSerializer
Can be set to a function which will be used to serialize each value during stringifying.
It will be called with the value
and the key
(i.e. (value: unknown, key: PropertyKey) => string
).
For example:
stringify({foo: 'bar'}, {
valueSerializer: (val) => String(val) + String(val)
});
// foo=barbar
Note that you can import the default serializer if you only want to handle some cases.
For example:
import {defaultValueSerializer, stringify} from 'picoquery';
stringify({foo: 'bar'}, {
valueSerializer: (val, key) => {
if (val instanceof Date) {
return val.toISOString();
}
// Call the original serializer otherwise
return defaultValueSerializer(val, key);
}
});
IMPORTANT: there are a few things to take into account with these benchmarks:
fast-querystring
is not capable of parsing or stringifying nested objects,
so the results are incomparible (but here as reference)Benchmark: Basic (no nesting)
āāāāāāāāāāā¬āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¬āāāāāāāāāāāāāā¬āāāāāāāāāāāāāāāāāāāāā¬āāāāāāāāāāā¬āāāāāāāāāā
ā (index) ā Task Name ā ops/sec ā Average Time (ns) ā Margin ā Samples ā
āāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāā¼āāāāāāāāāāā¼āāāāāāāāāā¤
ā 0 ā 'picoquery' ā '2,393,539' ā 417.79130492907393 ā '±0.42%' ā 1196770 ā
ā 1 ā 'qs' ā '382,933' ā 2611.4212945313157 ā '±1.04%' ā 191467 ā
ā 2 ā 'fast-querystring (no nesting)' ā '2,633,148' ā 379.77342802356833 ā '±1.58%' ā 1316575 ā
āāāāāāāāāāā“āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā“āāāāāāāāāāāāāā“āāāāāāāāāāāāāāāāāāāāā“āāāāāāāāāāā“āāāāāāāāāā
Benchmark: Dot-syntax nesting
āāāāāāāāāāā¬āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¬āāāāāāāāāāāāāā¬āāāāāāāāāāāāāāāāāāāā¬āāāāāāāāāāā¬āāāāāāāāāā
ā (index) ā Task Name ā ops/sec ā Average Time (ns) ā Margin ā Samples ā
āāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāā¼āāāāāāāāāāā¼āāāāāāāāāā¤
ā 0 ā 'picoquery' ā '1,406,039' ā 711.2176054736389 ā '±0.56%' ā 703020 ā
ā 1 ā 'qs' ā '205,611' ā 4863.536155478235 ā '±0.98%' ā 102806 ā
ā 2 ā 'fast-querystring (no nesting)' ā '2,588,560' ā 386.3151031345139 ā '±0.66%' ā 1294281 ā
āāāāāāāāāāā“āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā“āāāāāāāāāāāāāā“āāāāāāāāāāāāāāāāāāāā“āāāāāāāāāāā“āāāāāāāāāā
Benchmark: Basic (no nesting)
āāāāāāāāāāā¬āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¬āāāāāāāāāāāāāā¬āāāāāāāāāāāāāāāāāāāāā¬āāāāāāāāāāā¬āāāāāāāāāā
ā (index) ā Task Name ā ops/sec ā Average Time (ns) ā Margin ā Samples ā
āāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāā¼āāāāāāāāāāā¼āāāāāāāāāā¤
ā 0 ā 'picoquery' ā '4,163,092' ā 240.20605684139227 ā '±0.16%' ā 2081547 ā
ā 1 ā 'qs' ā '843,630' ā 1185.352608720127 ā '±0.76%' ā 421816 ā
ā 2 ā 'fast-querystring (no nesting)' ā '3,795,565' ā 263.46536774751036 ā '±0.24%' ā 1897783 ā
āāāāāāāāāāā“āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā“āāāāāāāāāāāāāā“āāāāāāāāāāāāāāāāāāāāā“āāāāāāāāāāā“āāāāāāāāāā
Benchmark: Dot-syntax nesting
āāāāāāāāāāā¬āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¬āāāāāāāāāāāāāā¬āāāāāāāāāāāāāāāāāāāāā¬āāāāāāāāāāā¬āāāāāāāāāā
ā (index) ā Task Name ā ops/sec ā Average Time (ns) ā Margin ā Samples ā
āāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¼āāāāāāāāāāāāāā¼āāāāāāāāāāāāāāāāāāāāā¼āāāāāāāāāāā¼āāāāāāāāāā¤
ā 0 ā 'picoquery' ā '1,768,770' ā 565.3644818387182 ā '±1.08%' ā 884387 ā
ā 1 ā 'qs' ā '332,254' ā 3009.743667534287 ā '±1.38%' ā 166128 ā
ā 2 ā 'fast-querystring (no nesting)' ā '7,227,031' ā 138.36940410118828 ā '±1.15%' ā 3613517 ā
āāāāāāāāāāā“āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā“āāāāāāāāāāāāāā“āāāāāāāāāāāāāāāāāāāāā“āāāāāāāāāāā“āāāāāāāāāā
MIT
FAQs
A small library for parsing and serialisation query strings
The npm package picoquery receives a total of 2,552 weekly downloads. As such, picoquery popularity was classified as popular.
We found that picoquery demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.Ā It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
CAI is a new open source AI framework that automates penetration testing tasks like scanning and exploitation up to 3,600Ć faster than humans.
Security News
Deno 2.4 brings back bundling, improves dependency updates and telemetry, and makes the runtime more practical for real-world JavaScript projects.
Security News
CVEForecast.org uses machine learning to project a record-breaking surge in vulnerability disclosures in 2025.