qs - npm Package Compare versions

Comparing version 3.1.0 to 4.0.0

lib/parse.js

@@ -13,3 +13,5 @@ // Load modules
     parameterLimit: 1000,
-    strictNullHandling: false
+    strictNullHandling: false,
+    plainObjects: false,
+    allowPrototypes: false
 };
@@ -65,3 +67,3 @@
     else {
-        obj = Object.create(null);
+        obj = options.plainObjects ? Object.create(null) : {};
         var cleanRoot = root[0] === '[' && root[root.length - 1] === ']' ? root.slice(1, root.length - 1) : root;
@@ -114,2 +116,12 @@ var index = parseInt(cleanRoot, 10);
     if (segment[1]) {
+        // If we aren't using plain objects, optionally prefix keys
+        // that would overwrite object prototype properties
+        if (!options.plainObjects &&
+            Object.prototype.hasOwnProperty(segment[1])) {
+
+            if (!options.allowPrototypes) {
+                return;
+            }
+        }
+
         keys.push(segment[1]);
@@ -124,2 +136,9 @@ }
         ++i;
+        if (!options.plainObjects &&
+            Object.prototype.hasOwnProperty(segment[1].replace(/\[|\]/g, ''))) {
+
+            if (!options.allowPrototypes) {
+                continue;
+            }
+        }
         keys.push(segment[1]);
@@ -140,9 +159,2 @@ }
 
-    if (str === '' ||
-        str === null ||
-        typeof str === 'undefined') {
-
-        return Object.create(null);
-    }
-
     options = options || {};
@@ -154,8 +166,16 @@ options.delimiter = typeof options.delimiter === 'string' || Utils.isRegExp(options.delimiter) ? options.delimiter : internals.delimiter;
     options.allowDots = options.allowDots !== false;
+    options.plainObjects = typeof options.plainObjects === 'boolean' ? options.plainObjects : internals.plainObjects;
+    options.allowPrototypes = typeof options.allowPrototypes === 'boolean' ? options.allowPrototypes : internals.allowPrototypes;
     options.parameterLimit = typeof options.parameterLimit === 'number' ? options.parameterLimit : internals.parameterLimit;
     options.strictNullHandling = typeof options.strictNullHandling === 'boolean' ? options.strictNullHandling : internals.strictNullHandling;
 
+    if (str === '' ||
+        str === null ||
+        typeof str === 'undefined') {
 
+        return options.plainObjects ? Object.create(null) : {};
+    }
+
     var tempObj = typeof str === 'string' ? internals.parseValues(str, options) : str;
-    var obj = Object.create(null);
+    var obj = options.plainObjects ? Object.create(null) : {};
 
@@ -168,3 +188,3 @@ // Iterate over the keys and setup the new object
         var newObj = internals.parseKeys(key, tempObj[key], options);
-        obj = Utils.merge(obj, newObj);
+        obj = Utils.merge(obj, newObj, options);
     }
@@ -171,0 +191,0 @@

lib/utils.js

@@ -8,10 +8,10 @@ // Load modules
 internals.hexTable = new Array(256);
-for (var i = 0; i < 256; ++i) {
-    internals.hexTable[i] = '%' + ((i < 16 ? '0' : '') + i.toString(16)).toUpperCase();
+for (var h = 0; h < 256; ++h) {
+    internals.hexTable[h] = '%' + ((h < 16 ? '0' : '') + h.toString(16)).toUpperCase();
 }
 
 
-exports.arrayToObject = function (source) {
+exports.arrayToObject = function (source, options) {
 
-    var obj = Object.create(null);
+    var obj = options.plainObjects ? Object.create(null) : {};
     for (var i = 0, il = source.length; i < il; ++i) {
@@ -28,3 +28,3 @@ if (typeof source[i] !== 'undefined') {
 
-exports.merge = function (target, source) {
+exports.merge = function (target, source, options) {
 
@@ -57,3 +57,3 @@ if (!source) {
 
-        target = exports.arrayToObject(target);
+        target = exports.arrayToObject(target, options);
     }
@@ -66,7 +66,7 @@
 
-        if (!target[key]) {
+        if (!Object.prototype.hasOwnProperty.call(target, key)) {
             target[key] = value;
         }
         else {
-            target[key] = exports.merge(target[key], value);
+            target[key] = exports.merge(target[key], value, options);
         }
@@ -73,0 +73,0 @@ }

package.json

 {
   "name": "qs",
-  "version": "3.1.0",
+  "version": "4.0.0",
   "description": "A querystring parser that supports nesting and arrays, with a depth limit",
   "homepage": "https://github.com/hapijs/qs",
-  "main": "index.js",
+  "main": "lib/index.js",
   "dependencies": {},
@@ -14,4 +14,5 @@ "devDependencies": {
   "scripts": {
-    "test": "make test-cov",
-    "dist": "browserify --standalone Qs index.js > dist/qs.js"
+    "test": "lab -a code -t 100 -L",
+    "test-cov-html": "lab -a code -r html -o coverage.html",
+    "dist": "browserify --standalone Qs lib/index.js > dist/qs.js"
   },
@@ -18,0 +19,0 @@ "repository": {

README.md

@@ -37,9 +37,16 @@ # qs
 
-The parsed value is returned as a plain object, created via `Object.create(null)` and as such you should be aware that prototype methods do not exist on it and a user may set those names to whatever value they like:
+When using the `plainObjects` option the parsed value is returned as a plain object, created via `Object.create(null)` and as such you should be aware that prototype methods will not exist on it and a user may set those names to whatever value they like:
 
 ```javascript
-Qs.parse('a.hasOwnProperty=b');
+Qs.parse('a.hasOwnProperty=b', { plainObjects: true });
 // { a: { hasOwnProperty: 'b' } }
 ```
 
+By default parameters that would overwrite properties on the object prototype are ignored, if you wish to keep the data from those fields either use `plainObjects` as mentioned above, or set `allowPrototypes` to `true` which will allow user input to overwrite those properties. *WARNING* It is generally a bad idea to enable this option as it can cause problems when attempting to use the properties that have been overwritten. Always be careful with this option.
+
+```javascript
+Qs.parse('a.hasOwnProperty=b', { allowPrototypes: true });
+// { a: { hasOwnProperty: 'b' } }
+```
+
 URI encoded strings work too:
@@ -115,2 +122,9 @@
 
+Option `allowDots` can be used to disable dot notation:
+
+```javascript
+Qs.parse('a.b=c', { allowDots: false });
+// { 'a.b': 'c' } }
+```
+
 ### Parsing Arrays
@@ -117,0 +131,0 @@

test/parse.js

@@ -26,17 +26,17 @@ /* eslint no-extend-native:0 */
 
-        expect(Qs.parse('0=foo')).to.deep.equal({ '0': 'foo' }, { prototype: false });
-        expect(Qs.parse('foo=c++')).to.deep.equal({ foo: 'c  ' }, { prototype: false });
-        expect(Qs.parse('a[>=]=23')).to.deep.equal({ a: { '>=': '23' } }, { prototype: false });
-        expect(Qs.parse('a[<=>]==23')).to.deep.equal({ a: { '<=>': '=23' } }, { prototype: false });
-        expect(Qs.parse('a[==]=23')).to.deep.equal({ a: { '==': '23' } }, { prototype: false });
-        expect(Qs.parse('foo', {strictNullHandling: true})).to.deep.equal({ foo: null }, { prototype: false });
-        expect(Qs.parse('foo' )).to.deep.equal({ foo: '' }, { prototype: false });
-        expect(Qs.parse('foo=')).to.deep.equal({ foo: '' }, { prototype: false });
-        expect(Qs.parse('foo=bar')).to.deep.equal({ foo: 'bar' }, { prototype: false });
-        expect(Qs.parse(' foo = bar = baz ')).to.deep.equal({ ' foo ': ' bar = baz ' }, { prototype: false });
-        expect(Qs.parse('foo=bar=baz')).to.deep.equal({ foo: 'bar=baz' }, { prototype: false });
-        expect(Qs.parse('foo=bar&bar=baz')).to.deep.equal({ foo: 'bar', bar: 'baz' }, { prototype: false });
-        expect(Qs.parse('foo2=bar2&baz2=')).to.deep.equal({ foo2: 'bar2', baz2: '' }, { prototype: false });
-        expect(Qs.parse('foo=bar&baz', {strictNullHandling: true})).to.deep.equal({ foo: 'bar', baz: null }, { prototype: false });
-        expect(Qs.parse('foo=bar&baz')).to.deep.equal({ foo: 'bar', baz: '' }, { prototype: false });
+        expect(Qs.parse('0=foo')).to.deep.equal({ '0': 'foo' });
+        expect(Qs.parse('foo=c++')).to.deep.equal({ foo: 'c  ' });
+        expect(Qs.parse('a[>=]=23')).to.deep.equal({ a: { '>=': '23' } });
+        expect(Qs.parse('a[<=>]==23')).to.deep.equal({ a: { '<=>': '=23' } });
+        expect(Qs.parse('a[==]=23')).to.deep.equal({ a: { '==': '23' } });
+        expect(Qs.parse('foo', { strictNullHandling: true })).to.deep.equal({ foo: null });
+        expect(Qs.parse('foo' )).to.deep.equal({ foo: '' });
+        expect(Qs.parse('foo=')).to.deep.equal({ foo: '' });
+        expect(Qs.parse('foo=bar')).to.deep.equal({ foo: 'bar' });
+        expect(Qs.parse(' foo = bar = baz ')).to.deep.equal({ ' foo ': ' bar = baz ' });
+        expect(Qs.parse('foo=bar=baz')).to.deep.equal({ foo: 'bar=baz' });
+        expect(Qs.parse('foo=bar&bar=baz')).to.deep.equal({ foo: 'bar', bar: 'baz' });
+        expect(Qs.parse('foo2=bar2&baz2=')).to.deep.equal({ foo2: 'bar2', baz2: '' });
+        expect(Qs.parse('foo=bar&baz', { strictNullHandling: true })).to.deep.equal({ foo: 'bar', baz: null });
+        expect(Qs.parse('foo=bar&baz')).to.deep.equal({ foo: 'bar', baz: '' });
         expect(Qs.parse('cht=p3&chd=t:60,40&chs=250x100&chl=Hello|World')).to.deep.equal({
@@ -47,3 +47,3 @@ cht: 'p3',
             chl: 'Hello|World'
-        }, { prototype: false });
+        });
         done();
@@ -54,4 +54,4 @@ });
 
-        expect(Qs.parse('a.b=c')).to.deep.equal({ a: { b: 'c' } }, { prototype: false });
-        expect(Qs.parse('a.b=c', { allowDots: false })).to.deep.equal({ 'a.b': 'c' }, { prototype: false });
+        expect(Qs.parse('a.b=c')).to.deep.equal({ a: { b: 'c' } });
+        expect(Qs.parse('a.b=c', { allowDots: false })).to.deep.equal({ 'a.b': 'c' });
         done();
@@ -62,3 +62,3 @@ });
 
-        expect(Qs.parse('a[b]=c')).to.deep.equal({ a: { b: 'c' } }, { prototype: false });
+        expect(Qs.parse('a[b]=c')).to.deep.equal({ a: { b: 'c' } });
         done();
@@ -69,3 +69,3 @@ });
 
-        expect(Qs.parse('a[b][c]=d')).to.deep.equal({ a: { b: { c: 'd' } } }, { prototype: false });
+        expect(Qs.parse('a[b][c]=d')).to.deep.equal({ a: { b: { c: 'd' } } });
         done();
@@ -76,3 +76,3 @@ });
 
-        expect(Qs.parse('a[b][c][d][e][f][g][h]=i')).to.deep.equal({ a: { b: { c: { d: { e: { f: { '[g][h]': 'i' } } } } } } }, { prototype: false });
+        expect(Qs.parse('a[b][c][d][e][f][g][h]=i')).to.deep.equal({ a: { b: { c: { d: { e: { f: { '[g][h]': 'i' } } } } } } });
         done();
@@ -83,4 +83,4 @@ });
 
-        expect(Qs.parse('a[b][c]=d', { depth: 1 })).to.deep.equal({ a: { b: { '[c]': 'd' } } }, { prototype: false });
-        expect(Qs.parse('a[b][c][d]=e', { depth: 1 })).to.deep.equal({ a: { b: { '[c][d]': 'e' } } }, { prototype: false });
+        expect(Qs.parse('a[b][c]=d', { depth: 1 })).to.deep.equal({ a: { b: { '[c]': 'd' } } });
+        expect(Qs.parse('a[b][c][d]=e', { depth: 1 })).to.deep.equal({ a: { b: { '[c][d]': 'e' } } });
         done();
@@ -91,3 +91,3 @@ });
 
-        expect(Qs.parse('a=b&a=c')).to.deep.equal({ a: ['b', 'c'] }, { prototype: false });
+        expect(Qs.parse('a=b&a=c')).to.deep.equal({ a: ['b', 'c'] });
         done();
@@ -98,5 +98,5 @@ });
 
-        expect(Qs.parse('a[]=b')).to.deep.equal({ a: ['b'] }, { prototype: false });
-        expect(Qs.parse('a[]=b&a[]=c')).to.deep.equal({ a: ['b', 'c'] }, { prototype: false });
-        expect(Qs.parse('a[]=b&a[]=c&a[]=d')).to.deep.equal({ a: ['b', 'c', 'd'] }, { prototype: false });
+        expect(Qs.parse('a[]=b')).to.deep.equal({ a: ['b'] });
+        expect(Qs.parse('a[]=b&a[]=c')).to.deep.equal({ a: ['b', 'c'] });
+        expect(Qs.parse('a[]=b&a[]=c&a[]=d')).to.deep.equal({ a: ['b', 'c', 'd'] });
         done();
@@ -107,8 +107,8 @@ });
 
-        expect(Qs.parse('a=b&a[]=c')).to.deep.equal({ a: ['b', 'c'] }, { prototype: false });
-        expect(Qs.parse('a[]=b&a=c')).to.deep.equal({ a: ['b', 'c'] }, { prototype: false });
-        expect(Qs.parse('a[0]=b&a=c')).to.deep.equal({ a: ['b', 'c'] }, { prototype: false });
-        expect(Qs.parse('a=b&a[0]=c')).to.deep.equal({ a: ['b', 'c'] }, { prototype: false });
-        expect(Qs.parse('a[1]=b&a=c')).to.deep.equal({ a: ['b', 'c'] }, { prototype: false });
-        expect(Qs.parse('a=b&a[1]=c')).to.deep.equal({ a: ['b', 'c'] }, { prototype: false });
+        expect(Qs.parse('a=b&a[]=c')).to.deep.equal({ a: ['b', 'c'] });
+        expect(Qs.parse('a[]=b&a=c')).to.deep.equal({ a: ['b', 'c'] });
+        expect(Qs.parse('a[0]=b&a=c')).to.deep.equal({ a: ['b', 'c'] });
+        expect(Qs.parse('a=b&a[0]=c')).to.deep.equal({ a: ['b', 'c'] });
+        expect(Qs.parse('a[1]=b&a=c')).to.deep.equal({ a: ['b', 'c'] });
+        expect(Qs.parse('a=b&a[1]=c')).to.deep.equal({ a: ['b', 'c'] });
         done();
@@ -119,4 +119,4 @@ });
 
-        expect(Qs.parse('a[b][]=c&a[b][]=d')).to.deep.equal({ a: { b: ['c', 'd'] } }, { prototype: false });
-        expect(Qs.parse('a[>=]=25')).to.deep.equal({ a: { '>=': '25' } }, { prototype: false });
+        expect(Qs.parse('a[b][]=c&a[b][]=d')).to.deep.equal({ a: { b: ['c', 'd'] } });
+        expect(Qs.parse('a[>=]=25')).to.deep.equal({ a: { '>=': '25' } });
         done();
@@ -127,5 +127,5 @@ });
 
-        expect(Qs.parse('a[1]=c&a[0]=b&a[2]=d')).to.deep.equal({ a: ['b', 'c', 'd'] }, { prototype: false });
-        expect(Qs.parse('a[1]=c&a[0]=b')).to.deep.equal({ a: ['b', 'c'] }, { prototype: false });
-        expect(Qs.parse('a[1]=c')).to.deep.equal({ a: ['c'] }, { prototype: false });
+        expect(Qs.parse('a[1]=c&a[0]=b&a[2]=d')).to.deep.equal({ a: ['b', 'c', 'd'] });
+        expect(Qs.parse('a[1]=c&a[0]=b')).to.deep.equal({ a: ['b', 'c'] });
+        expect(Qs.parse('a[1]=c')).to.deep.equal({ a: ['c'] });
         done();
@@ -136,4 +136,4 @@ });
 
-        expect(Qs.parse('a[20]=a')).to.deep.equal({ a: ['a'] }, { prototype: false });
-        expect(Qs.parse('a[21]=a')).to.deep.equal({ a: { '21': 'a' } }, { prototype: false });
+        expect(Qs.parse('a[20]=a')).to.deep.equal({ a: ['a'] });
+        expect(Qs.parse('a[21]=a')).to.deep.equal({ a: { '21': 'a' } });
         done();
@@ -144,3 +144,3 @@ });
 
-        expect(Qs.parse('a[12b]=c')).to.deep.equal({ a: { '12b': 'c' } }, { prototype: false });
+        expect(Qs.parse('a[12b]=c')).to.deep.equal({ a: { '12b': 'c' } });
         done();
@@ -151,3 +151,3 @@ });
 
-        expect(Qs.parse('he%3Dllo=th%3Dere')).to.deep.equal({ 'he=llo': 'th=ere' }, { prototype: false });
+        expect(Qs.parse('he%3Dllo=th%3Dere')).to.deep.equal({ 'he=llo': 'th=ere' });
         done();
@@ -158,4 +158,4 @@ });
 
-        expect(Qs.parse('a[b%20c]=d')).to.deep.equal({ a: { 'b c': 'd' } }, { prototype: false });
-        expect(Qs.parse('a[b]=c%20d')).to.deep.equal({ a: { b: 'c d' } }, { prototype: false });
+        expect(Qs.parse('a[b%20c]=d')).to.deep.equal({ a: { 'b c': 'd' } });
+        expect(Qs.parse('a[b]=c%20d')).to.deep.equal({ a: { b: 'c d' } });
         done();
@@ -166,4 +166,4 @@ });
 
-        expect(Qs.parse('pets=["tobi"]')).to.deep.equal({ pets: '["tobi"]' }, { prototype: false });
-        expect(Qs.parse('operators=[">=", "<="]')).to.deep.equal({ operators: '[">=", "<="]' }, { prototype: false });
+        expect(Qs.parse('pets=["tobi"]')).to.deep.equal({ pets: '["tobi"]' });
+        expect(Qs.parse('operators=[">=", "<="]')).to.deep.equal({ operators: '[">=", "<="]' });
         done();
@@ -174,5 +174,5 @@ });
 
-        expect(Qs.parse('')).to.deep.equal({}, { prototype: false });
-        expect(Qs.parse(null)).to.deep.equal({}, { prototype: false });
-        expect(Qs.parse(undefined)).to.deep.equal({}, { prototype: false });
+        expect(Qs.parse('')).to.deep.equal({});
+        expect(Qs.parse(null)).to.deep.equal({});
+        expect(Qs.parse(undefined)).to.deep.equal({});
         done();
@@ -183,10 +183,10 @@ });
 
-        expect(Qs.parse('foo[0]=bar&foo[bad]=baz')).to.deep.equal({ foo: { '0': 'bar', bad: 'baz' } }, { prototype: false });
-        expect(Qs.parse('foo[bad]=baz&foo[0]=bar')).to.deep.equal({ foo: { bad: 'baz', '0': 'bar' } }, { prototype: false });
-        expect(Qs.parse('foo[bad]=baz&foo[]=bar')).to.deep.equal({ foo: { bad: 'baz', '0': 'bar' } }, { prototype: false });
-        expect(Qs.parse('foo[]=bar&foo[bad]=baz')).to.deep.equal({ foo: { '0': 'bar', bad: 'baz' } }, { prototype: false });
-        expect(Qs.parse('foo[bad]=baz&foo[]=bar&foo[]=foo')).to.deep.equal({ foo: { bad: 'baz', '0': 'bar', '1': 'foo' } }, { prototype: false });
-        expect(Qs.parse('foo[0][a]=a&foo[0][b]=b&foo[1][a]=aa&foo[1][b]=bb')).to.deep.equal({foo: [ {a: 'a', b: 'b'}, {a: 'aa', b: 'bb'} ]}, { prototype: false });
-        expect(Qs.parse('a[]=b&a[t]=u&a[hasOwnProperty]=c')).to.deep.equal({ a: { '0': 'b', t: 'u', hasOwnProperty: 'c' } }, { prototype: false });
-        expect(Qs.parse('a[]=b&a[hasOwnProperty]=c&a[x]=y')).to.deep.equal({ a: { '0': 'b', hasOwnProperty: 'c', x: 'y' } }, { prototype: false });
+        expect(Qs.parse('foo[0]=bar&foo[bad]=baz')).to.deep.equal({ foo: { '0': 'bar', bad: 'baz' } });
+        expect(Qs.parse('foo[bad]=baz&foo[0]=bar')).to.deep.equal({ foo: { bad: 'baz', '0': 'bar' } });
+        expect(Qs.parse('foo[bad]=baz&foo[]=bar')).to.deep.equal({ foo: { bad: 'baz', '0': 'bar' } });
+        expect(Qs.parse('foo[]=bar&foo[bad]=baz')).to.deep.equal({ foo: { '0': 'bar', bad: 'baz' } });
+        expect(Qs.parse('foo[bad]=baz&foo[]=bar&foo[]=foo')).to.deep.equal({ foo: { bad: 'baz', '0': 'bar', '1': 'foo' } });
+        expect(Qs.parse('foo[0][a]=a&foo[0][b]=b&foo[1][a]=aa&foo[1][b]=bb')).to.deep.equal({ foo: [{ a: 'a', b: 'b' }, { a: 'aa', b: 'bb' }] });
+        expect(Qs.parse('a[]=b&a[t]=u&a[hasOwnProperty]=c')).to.deep.equal({ a: { '0': 'b', t: 'u', c: true } });
+        expect(Qs.parse('a[]=b&a[hasOwnProperty]=c&a[x]=y')).to.deep.equal({ a: { '0': 'b', '1': 'c', x: 'y' } });
         done();
@@ -197,12 +197,12 @@ });
 
-        expect(Qs.parse('foo[0].baz=bar&fool.bad=baz')).to.deep.equal({ foo: [ { baz: 'bar'} ], fool: { bad: 'baz' } }, { prototype: false });
-        expect(Qs.parse('foo[0].baz=bar&fool.bad.boo=baz')).to.deep.equal({ foo: [ { baz: 'bar'} ], fool: { bad: { boo: 'baz' } } }, { prototype: false });
-        expect(Qs.parse('foo[0][0].baz=bar&fool.bad=baz')).to.deep.equal({ foo: [[ { baz: 'bar'} ]], fool: { bad: 'baz' } }, { prototype: false });
-        expect(Qs.parse('foo[0].baz[0]=15&foo[0].bar=2')).to.deep.equal({ foo: [{ baz: ['15'], bar: '2' }] }, { prototype: false });
-        expect(Qs.parse('foo[0].baz[0]=15&foo[0].baz[1]=16&foo[0].bar=2')).to.deep.equal({ foo: [{ baz: ['15', '16'], bar: '2' }] }, { prototype: false });
-        expect(Qs.parse('foo.bad=baz&foo[0]=bar')).to.deep.equal({ foo: { bad: 'baz', '0': 'bar' } }, { prototype: false });
-        expect(Qs.parse('foo.bad=baz&foo[]=bar')).to.deep.equal({ foo: { bad: 'baz', '0': 'bar' } }, { prototype: false });
-        expect(Qs.parse('foo[]=bar&foo.bad=baz')).to.deep.equal({ foo: { '0': 'bar', bad: 'baz' } }, { prototype: false });
-        expect(Qs.parse('foo.bad=baz&foo[]=bar&foo[]=foo')).to.deep.equal({ foo: { bad: 'baz', '0': 'bar', '1': 'foo' } }, { prototype: false });
-        expect(Qs.parse('foo[0].a=a&foo[0].b=b&foo[1].a=aa&foo[1].b=bb')).to.deep.equal({foo: [ {a: 'a', b: 'b'}, {a: 'aa', b: 'bb'} ]}, { prototype: false });
+        expect(Qs.parse('foo[0].baz=bar&fool.bad=baz')).to.deep.equal({ foo: [{ baz: 'bar' }], fool: { bad: 'baz' } });
+        expect(Qs.parse('foo[0].baz=bar&fool.bad.boo=baz')).to.deep.equal({ foo: [{ baz: 'bar' }], fool: { bad: { boo: 'baz' } } });
+        expect(Qs.parse('foo[0][0].baz=bar&fool.bad=baz')).to.deep.equal({ foo: [[{ baz: 'bar' }]], fool: { bad: 'baz' } });
+        expect(Qs.parse('foo[0].baz[0]=15&foo[0].bar=2')).to.deep.equal({ foo: [{ baz: ['15'], bar: '2' }] });
+        expect(Qs.parse('foo[0].baz[0]=15&foo[0].baz[1]=16&foo[0].bar=2')).to.deep.equal({ foo: [{ baz: ['15', '16'], bar: '2' }] });
+        expect(Qs.parse('foo.bad=baz&foo[0]=bar')).to.deep.equal({ foo: { bad: 'baz', '0': 'bar' } });
+        expect(Qs.parse('foo.bad=baz&foo[]=bar')).to.deep.equal({ foo: { bad: 'baz', '0': 'bar' } });
+        expect(Qs.parse('foo[]=bar&foo.bad=baz')).to.deep.equal({ foo: { '0': 'bar', bad: 'baz' } });
+        expect(Qs.parse('foo.bad=baz&foo[]=bar&foo[]=foo')).to.deep.equal({ foo: { bad: 'baz', '0': 'bar', '1': 'foo' } });
+        expect(Qs.parse('foo[0].a=a&foo[0].b=b&foo[1].a=aa&foo[1].b=bb')).to.deep.equal({ foo: [{ a: 'a', b: 'b' }, { a: 'aa', b: 'bb' }] });
         done();
@@ -213,3 +213,3 @@ });
 
-        expect(Qs.parse('a[b]=c&a=d')).to.deep.equal({ a: { b: 'c', d: true } }, { prototype: false });
+        expect(Qs.parse('a[b]=c&a=d')).to.deep.equal({ a: { b: 'c', d: true } });
         done();
@@ -220,3 +220,3 @@ });
 
-        expect(Qs.parse('a[2]=b&a[99999999]=c')).to.deep.equal({ a: { '2': 'b', '99999999': 'c' } }, { prototype: false });
+        expect(Qs.parse('a[2]=b&a[99999999]=c')).to.deep.equal({ a: { '2': 'b', '99999999': 'c' } });
         done();
@@ -227,5 +227,5 @@ });
 
-        expect(Qs.parse('{%:%}', {strictNullHandling: true})).to.deep.equal({ '{%:%}': null }, { prototype: false });
-        expect(Qs.parse('{%:%}=')).to.deep.equal({ '{%:%}': '' }, { prototype: false });
-        expect(Qs.parse('foo=%:%}')).to.deep.equal({ foo: '%:%}' }, { prototype: false });
+        expect(Qs.parse('{%:%}', { strictNullHandling: true })).to.deep.equal({ '{%:%}': null });
+        expect(Qs.parse('{%:%}=')).to.deep.equal({ '{%:%}': '' });
+        expect(Qs.parse('foo=%:%}')).to.deep.equal({ foo: '%:%}' });
         done();
@@ -236,3 +236,3 @@ });
 
-        expect(Qs.parse('_r=1&')).to.deep.equal({ '_r': '1' }, { prototype: false });
+        expect(Qs.parse('_r=1&')).to.deep.equal({ '_r': '1' });
         done();
@@ -251,4 +251,4 @@ });
 
-        expect(Qs.parse('a[][b]=c')).to.deep.equal({ a: [{ b: 'c' }] }, { prototype: false });
-        expect(Qs.parse('a[0][b]=c')).to.deep.equal({ a: [{ b: 'c' }] }, { prototype: false });
+        expect(Qs.parse('a[][b]=c')).to.deep.equal({ a: [{ b: 'c' }] });
+        expect(Qs.parse('a[0][b]=c')).to.deep.equal({ a: [{ b: 'c' }] });
         done();
@@ -259,6 +259,6 @@ });
 
-        expect(Qs.parse('a[]=b&a[]=&a[]=c')).to.deep.equal({ a: ['b', '', 'c'] }, { prototype: false });
-        expect(Qs.parse('a[0]=b&a[1]&a[2]=c&a[19]=', {strictNullHandling: true})).to.deep.equal({ a: ['b', null, 'c', ''] }, { prototype: false });
-        expect(Qs.parse('a[0]=b&a[1]=&a[2]=c&a[19]', {strictNullHandling: true})).to.deep.equal({ a: ['b', '', 'c', null] }, { prototype: false });
-        expect(Qs.parse('a[]=&a[]=b&a[]=c')).to.deep.equal({ a: ['', 'b', 'c'] }, { prototype: false });
+        expect(Qs.parse('a[]=b&a[]=&a[]=c')).to.deep.equal({ a: ['b', '', 'c'] });
+        expect(Qs.parse('a[0]=b&a[1]&a[2]=c&a[19]=', { strictNullHandling: true })).to.deep.equal({ a: ['b', null, 'c', ''] });
+        expect(Qs.parse('a[0]=b&a[1]=&a[2]=c&a[19]', { strictNullHandling: true })).to.deep.equal({ a: ['b', '', 'c', null] });
+        expect(Qs.parse('a[]=&a[]=b&a[]=c')).to.deep.equal({ a: ['', 'b', 'c'] });
         done();
@@ -269,3 +269,3 @@ });
 
-        expect(Qs.parse('a[10]=1&a[2]=2')).to.deep.equal({ a: ['2', '1'] }, { prototype: false });
+        expect(Qs.parse('a[10]=1&a[2]=2')).to.deep.equal({ a: ['2', '1'] });
         done();
@@ -276,4 +276,4 @@ });
 
-        expect(Qs.parse({ 'a[b]': 'c' })).to.deep.equal({ a: { b: 'c' } }, { prototype: false });
-        expect(Qs.parse({ 'a[b]': 'c', 'a[d]': 'e' })).to.deep.equal({ a: { b: 'c', d: 'e' } }, { prototype: false });
+        expect(Qs.parse({ 'a[b]': 'c' })).to.deep.equal({ a: { b: 'c' } });
+        expect(Qs.parse({ 'a[b]': 'c', 'a[d]': 'e' })).to.deep.equal({ a: { b: 'c', d: 'e' } });
         done();
@@ -285,3 +285,3 @@ });
         var b = new Buffer('test');
-        expect(Qs.parse({ a: b })).to.deep.equal({ a: b }, { prototype: false });
+        expect(Qs.parse({ a: b })).to.deep.equal({ a: b });
         done();
@@ -292,5 +292,5 @@ });
 
-        expect(Qs.parse('[]=&a=b')).to.deep.equal({ '0': '', a: 'b' }, { prototype: false });
-        expect(Qs.parse('[]&a=b', {strictNullHandling: true})).to.deep.equal({ '0': null, a: 'b' }, { prototype: false });
-        expect(Qs.parse('[foo]=bar')).to.deep.equal({ foo: 'bar' }, { prototype: false });
+        expect(Qs.parse('[]=&a=b')).to.deep.equal({ '0': '', a: 'b' });
+        expect(Qs.parse('[]&a=b', { strictNullHandling: true })).to.deep.equal({ '0': null, a: 'b' });
+        expect(Qs.parse('[foo]=bar')).to.deep.equal({ foo: 'bar' });
         done();
@@ -319,5 +319,5 @@ });
         expect(Qs.parse.bind(null, 'a=b')).to.not.throw();
-        expect(Qs.parse('a=b')).to.deep.equal({ a: 'b' }, { prototype: false });
+        expect(Qs.parse('a=b')).to.deep.equal({ a: 'b' });
         expect(Qs.parse.bind(null, 'a[][b]=c')).to.not.throw();
-        expect(Qs.parse('a[][b]=c')).to.deep.equal({ a: [{ b: 'c' }] }, { prototype: false });
+        expect(Qs.parse('a[][b]=c')).to.deep.equal({ a: [{ b: 'c' }] });
         delete Object.prototype.crash;
@@ -330,3 +330,3 @@ delete Array.prototype.crash;
 
-        expect(Qs.parse('a=b;c=d', { delimiter: ';' })).to.deep.equal({ a: 'b', c: 'd' }, { prototype: false });
+        expect(Qs.parse('a=b;c=d', { delimiter: ';' })).to.deep.equal({ a: 'b', c: 'd' });
         done();
@@ -337,3 +337,3 @@ });
 
-        expect(Qs.parse('a=b; c=d', { delimiter: /[;,] */ })).to.deep.equal({ a: 'b', c: 'd' }, { prototype: false });
+        expect(Qs.parse('a=b; c=d', { delimiter: /[;,] */ })).to.deep.equal({ a: 'b', c: 'd' });
         done();
@@ -344,3 +344,3 @@ });
 
-        expect(Qs.parse('a=b&c=d', { delimiter: true })).to.deep.equal({ a: 'b', c: 'd' }, { prototype: false });
+        expect(Qs.parse('a=b&c=d', { delimiter: true })).to.deep.equal({ a: 'b', c: 'd' });
         done();
@@ -351,3 +351,3 @@ });
 
-        expect(Qs.parse('a=b&c=d', { parameterLimit: 1 })).to.deep.equal({ a: 'b' }, { prototype: false });
+        expect(Qs.parse('a=b&c=d', { parameterLimit: 1 })).to.deep.equal({ a: 'b' });
         done();
@@ -358,3 +358,3 @@ });
 
-        expect(Qs.parse('a=b&c=d', { parameterLimit: Infinity })).to.deep.equal({ a: 'b', c: 'd' }, { prototype: false });
+        expect(Qs.parse('a=b&c=d', { parameterLimit: Infinity })).to.deep.equal({ a: 'b', c: 'd' });
         done();
@@ -365,5 +365,5 @@ });
 
-        expect(Qs.parse('a[0]=b', { arrayLimit: -1 })).to.deep.equal({ a: { '0': 'b' } }, { prototype: false });
-        expect(Qs.parse('a[-1]=b', { arrayLimit: -1 })).to.deep.equal({ a: { '-1': 'b' } }, { prototype: false });
-        expect(Qs.parse('a[0]=b&a[1]=c', { arrayLimit: 0 })).to.deep.equal({ a: { '0': 'b', '1': 'c' } }, { prototype: false });
+        expect(Qs.parse('a[0]=b', { arrayLimit: -1 })).to.deep.equal({ a: { '0': 'b' } });
+        expect(Qs.parse('a[-1]=b', { arrayLimit: -1 })).to.deep.equal({ a: { '-1': 'b' } });
+        expect(Qs.parse('a[0]=b&a[1]=c', { arrayLimit: 0 })).to.deep.equal({ a: { '0': 'b', '1': 'c' } });
         done();
@@ -374,3 +374,3 @@ });
 
-        expect(Qs.parse('a[0]=b&a[1]=c', { parseArrays: false })).to.deep.equal({ a: { '0': 'b', '1': 'c' } }, { prototype: false });
+        expect(Qs.parse('a[0]=b&a[1]=c', { parseArrays: false })).to.deep.equal({ a: { '0': 'b', '1': 'c' } });
         done();
@@ -382,3 +382,3 @@ });
         var input = {
-            'user[name]': {'pop[bob]': 3},
+            'user[name]': { 'pop[bob]': 3 },
             'user[email]': null
@@ -389,3 +389,3 @@ };
             'user': {
-                'name': {'pop[bob]': 3},
+                'name': { 'pop[bob]': 3 },
                 'email': null
@@ -397,3 +397,3 @@ }
 
-        expect(result).to.deep.equal(expected, { prototype: false });
+        expect(result).to.deep.equal(expected);
         done();
@@ -405,3 +405,3 @@ });
         var input = {
-            'user.name': {'pop[bob]': 3},
+            'user.name': { 'pop[bob]': 3 },
             'user.email.': null
@@ -412,3 +412,3 @@ };
             'user': {
-                'name': {'pop[bob]': 3},
+                'name': { 'pop[bob]': 3 },
                 'email': null
@@ -420,3 +420,3 @@ }
 
-        expect(result).to.deep.equal(expected, { prototype: false });
+        expect(result).to.deep.equal(expected);
         done();
@@ -428,3 +428,3 @@ });
         var input = {
-            'user[name]': {'pop[bob]': { 'test': 3 }},
+            'user[name]': { 'pop[bob]': { 'test': 3 } },
             'user[email]': null
@@ -435,3 +435,3 @@ };
             'user': {
-                'name': {'pop[bob]': { 'test': 3 }},
+                'name': { 'pop[bob]': { 'test': 3 } },
                 'email': null
@@ -443,3 +443,3 @@ }
 
-        expect(result).to.deep.equal(expected, { prototype: false });
+        expect(result).to.deep.equal(expected);
         done();
@@ -454,3 +454,3 @@ });
         global.Buffer = tempBuffer;
-        expect(result).to.deep.equal({ a: 'b', c: 'd' }, { prototype: false });
+        expect(result).to.deep.equal({ a: 'b', c: 'd' });
         done();
@@ -474,3 +474,3 @@ });
         expect(parsed.foo.bar).to.equal('baz');
-        expect(parsed.foo.baz).to.deep.equal(a, { prototype: false });
+        expect(parsed.foo.baz).to.deep.equal(a);
         done();
@@ -484,6 +484,6 @@ });
 
-        expect(Qs.parse(a)).to.deep.equal({ b: 'c' }, { prototype: false });
+        expect(Qs.parse(a)).to.deep.equal({ b: 'c' });
         var result = Qs.parse({ a: a });
         expect(result).to.contain('a');
-        expect(result.a).to.deep.equal(a, { prototype: false });
+        expect(result.a).to.deep.equal(a);
         done();
@@ -495,3 +495,3 @@ });
         var now = new Date();
-        expect(Qs.parse({ a: now })).to.deep.equal({ a: now }, { prototype: false });
+        expect(Qs.parse({ a: now })).to.deep.equal({ a: now });
         done();
@@ -503,5 +503,28 @@ });
         var re = /^test$/;
-        expect(Qs.parse({ a: re })).to.deep.equal({ a: re }, { prototype: false });
+        expect(Qs.parse({ a: re })).to.deep.equal({ a: re });
         done();
     });
+
+    it('can allow overwriting prototype properties', function (done) {
+
+        expect(Qs.parse('a[hasOwnProperty]=b', { allowPrototypes: true })).to.deep.equal({ a: { hasOwnProperty: 'b' } }, { prototype: false });
+        expect(Qs.parse('hasOwnProperty=b', { allowPrototypes: true })).to.deep.equal({ hasOwnProperty: 'b' }, { prototype: false });
+        done();
+    });
+
+    it('can return plain objects', function (done) {
+
+        var expected = Object.create(null);
+        expected.a = Object.create(null);
+        expected.a.b = 'c';
+        expected.a.hasOwnProperty = 'd';
+        expect(Qs.parse('a[b]=c&a[hasOwnProperty]=d', { plainObjects: true })).to.deep.equal(expected);
+        expect(Qs.parse(null, { plainObjects: true })).to.deep.equal(Object.create(null));
+        var expectedArray = Object.create(null);
+        expectedArray.a = Object.create(null);
+        expectedArray.a['0'] = 'b';
+        expectedArray.a.c = 'd';
+        expect(Qs.parse('a[]=b&a[c]=d', { plainObjects: true })).to.deep.equal(expectedArray);
+        done();
+    });
 });

test/stringify.js

@@ -114,10 +114,10 @@ /* eslint no-extend-native:0 */
         expect(Qs.stringify({ a: '' })).to.equal('a=');
-        expect(Qs.stringify({ a: null }, {strictNullHandling: true})).to.equal('a');
+        expect(Qs.stringify({ a: null }, { strictNullHandling: true })).to.equal('a');
 
         expect(Qs.stringify({ a: '', b: '' })).to.equal('a=&b=');
-        expect(Qs.stringify({ a: null, b: '' }, {strictNullHandling: true})).to.equal('a&b=');
+        expect(Qs.stringify({ a: null, b: '' }, { strictNullHandling: true })).to.equal('a&b=');
 
         expect(Qs.stringify({ a: { b: '' } })).to.equal('a%5Bb%5D=');
-        expect(Qs.stringify({ a: { b: null } }, {strictNullHandling: true})).to.equal('a%5Bb%5D');
-        expect(Qs.stringify({ a: { b: null } }, {strictNullHandling: false})).to.equal('a%5Bb%5D=');
+        expect(Qs.stringify({ a: { b: null } }, { strictNullHandling: true })).to.equal('a%5Bb%5D');
+        expect(Qs.stringify({ a: { b: null } }, { strictNullHandling: false })).to.equal('a%5Bb%5D=');
 
@@ -159,4 +159,4 @@ done();
 
-        expect(Qs.stringify({ a: { b: undefined, c: null } }, {strictNullHandling: true})).to.equal('a%5Bc%5D');
-        expect(Qs.stringify({ a: { b: undefined, c: null } }, {strictNullHandling: false})).to.equal('a%5Bc%5D=');
+        expect(Qs.stringify({ a: { b: undefined, c: null } }, { strictNullHandling: true })).to.equal('a%5Bc%5D');
+        expect(Qs.stringify({ a: { b: undefined, c: null } }, { strictNullHandling: false })).to.equal('a%5Bc%5D=');
         expect(Qs.stringify({ a: { b: undefined, c: '' } })).to.equal('a%5Bc%5D=');
@@ -189,3 +189,3 @@ done();
         Object.prototype.crash = 'test';
-        expect(Qs.stringify({ a: 'b'})).to.equal('a=b');
+        expect(Qs.stringify({ a: 'b' })).to.equal('a=b');
         expect(Qs.stringify({ a: { b: 'c' } })).to.equal('a%5Bb%5D=c');
@@ -230,4 +230,4 @@ delete Object.prototype.crash;
         expect(Qs.stringify({ a: 'b' }, { filter: ['a'] })).to.equal('a=b');
-        expect(Qs.stringify({ a: 1}, { filter: [] })).to.equal('');
-        expect(Qs.stringify({ a: { b: [1, 2, 3, 4], c: 'd' }, c: 'f' }, { filter: ['a', 'b', 0, 2]})).to.equal('a%5Bb%5D%5B0%5D=1&a%5Bb%5D%5B2%5D=3');
+        expect(Qs.stringify({ a: 1 }, { filter: [] })).to.equal('');
+        expect(Qs.stringify({ a: { b: [1, 2, 3, 4], c: 'd' }, c: 'f' }, { filter: ['a', 'b', 0, 2] })).to.equal('a%5Bb%5D%5B0%5D=1&a%5Bb%5D%5B2%5D=3');
         done();
@@ -234,0 +234,0 @@

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

56024

increased by0.4%

Lines of code

957

increased by3.91%

Number of lines in readme file

318

increased by4.61%

Worsened metrics

Number of package files

16

decreased by-20%

No dependency changes