qs - npm Package Compare versions

Comparing version 6.7.0 to 6.8.0

CHANGELOG.md

@@ -0,1 +1,15 @@
+## **6.8.0**
+- [New] add `depth=false` to preserve the original key; [Fix] `depth=0` should preserve the original key (#326)
+- [New] [Fix] stringify symbols and bigints
+- [Fix] ensure node 0.12 can stringify Symbols
+- [Fix] fix for an impossible situation: when the formatter is called with a non-string value
+- [Refactor] `formats`: tiny bit of cleanup.
+- [Dev Deps] update `eslint`, `@ljharb/eslint-config`, `browserify`, `safe-publish-latest`, `iconv-lite`, `tape`
+- [Tests] add tests for `depth=0` and `depth=false` behavior, both current and intuitive/intended (#326)
+- [Tests] use `eclint` instead of `editorconfig-tools`
+- [docs] readme: add security note
+- [meta] add github sponsorship
+- [meta] add FUNDING.yml
+- [meta] Clean up license text so it’s properly detected as BSD-3-Clause
+
 ## **6.7.0**
@@ -2,0 +16,0 @@ - [New] `stringify`/`parse`: add `comma` as an `arrayFormat` option (#276, #219)

dist/qs.js

@@ -7,12 +7,5 @@ (function(f){if(typeof exports==="object"&&typeof module!=="undefined"){module.exports=f()}else if(typeof define==="function"&&define.amd){define([],f)}else{var g;if(typeof window!=="undefined"){g=window}else if(typeof global!=="undefined"){g=global}else if(typeof self!=="undefined"){g=self}else{g=this}g.Qs = f()}})(function(){var define,module,exports;return (function(){function r(e,n,t){function o(i,f){if(!n[i]){if(!e[i]){var c="function"==typeof require&&require;if(!f&&c)return c(i,!0);if(u)return u(i,!0);var a=new Error("Cannot find module '"+i+"'");throw a.code="MODULE_NOT_FOUND",a}var p=n[i]={exports:{}};e[i][0].call(p.exports,function(r){var n=e[i][1][r];return o(n||r)},p,p.exports,r,e,n,t)}return n[i].exports}for(var u="function"==typeof require&&require,i=0;i<t.length;i++)o(t[i]);return o}return r})()({1:[function(require,module,exports){
 
-module.exports = {
-    'default': 'RFC3986',
-    formatters: {
-        RFC1738: function (value) {
-            return replace.call(value, percentTwenties, '+');
-        },
-        RFC3986: function (value) {
-            return value;
-        }
-    },
+var util = require('./utils');
+
+var Format = {
     RFC1738: 'RFC1738',
@@ -22,3 +15,18 @@ RFC3986: 'RFC3986'
 
-},{}],2:[function(require,module,exports){
+module.exports = util.assign(
+    {
+        'default': Format.RFC3986,
+        formatters: {
+            RFC1738: function (value) {
+                return replace.call(value, percentTwenties, '+');
+            },
+            RFC3986: function (value) {
+                return String(value);
+            }
+        }
+    },
+    Format
+);
+
+},{"./utils":5}],2:[function(require,module,exports){
 'use strict';
@@ -186,3 +194,3 @@
 
-    var segment = brackets.exec(key);
+    var segment = options.depth > 0 && brackets.exec(key);
     var parent = segment ? key.slice(0, segment.index) : key;
@@ -207,3 +215,3 @@
     var i = 0;
-    while ((segment = child.exec(key)) !== null && i < options.depth) {
+    while (options.depth > 0 && (segment = child.exec(key)) !== null && i < options.depth) {
         i += 1;
@@ -250,3 +258,4 @@ if (!options.plainObjects && has.call(Object.prototype, segment[1].slice(1, -1))) {
         delimiter: typeof opts.delimiter === 'string' || utils.isRegExp(opts.delimiter) ? opts.delimiter : defaults.delimiter,
-        depth: typeof opts.depth === 'number' ? opts.depth : defaults.depth,
+        // eslint-disable-next-line no-implicit-coercion, no-extra-parens
+        depth: (typeof opts.depth === 'number' || opts.depth === false) ? +opts.depth : defaults.depth,
         ignoreQueryPrefix: opts.ignoreQueryPrefix === true,
@@ -311,2 +320,3 @@ interpretNumericEntities: typeof opts.interpretNumericEntities === 'boolean' ? opts.interpretNumericEntities : defaults.interpretNumericEntities,
 
+var defaultFormat = formats['default'];
 var defaults = {
@@ -321,3 +331,4 @@ addQueryPrefix: false,
     encodeValuesOnly: false,
-    formatter: formats.formatters[formats['default']],
+    format: defaultFormat,
+    formatter: formats.formatters[defaultFormat],
     // deprecated
@@ -332,2 +343,10 @@ indices: false,
 
+var isNonNullishPrimitive = function isNonNullishPrimitive(v) { // eslint-disable-line func-name-matching
+    return typeof v === 'string'
+        || typeof v === 'number'
+        || typeof v === 'boolean'
+        || typeof v === 'symbol'
+        || typeof v === 'bigint'; // eslint-disable-line valid-typeof
+};
+
 var stringify = function stringify( // eslint-disable-line func-name-matching
@@ -365,3 +384,3 @@ object,
 
-    if (typeof obj === 'string' || typeof obj === 'number' || typeof obj === 'boolean' || utils.isBuffer(obj)) {
+    if (isNonNullishPrimitive(obj) || utils.isBuffer(obj)) {
         if (encoder) {
@@ -687,3 +706,8 @@ var keyValue = encodeValuesOnly ? prefix : encoder(prefix, defaults.encoder, charset);
 
-    var string = typeof str === 'string' ? str : String(str);
+    var string = str;
+    if (typeof str === 'symbol') {
+        string = Symbol.prototype.toString.call(str);
+    } else if (typeof str !== 'string') {
+        string = String(str);
+    }
 
@@ -690,0 +714,0 @@ if (charset === 'iso-8859-1') {

lib/formats.js

@@ -6,14 +6,22 @@ 'use strict';
 
-module.exports = {
-    'default': 'RFC3986',
-    formatters: {
-        RFC1738: function (value) {
-            return replace.call(value, percentTwenties, '+');
-        },
-        RFC3986: function (value) {
-            return value;
-        }
-    },
+var util = require('./utils');
+
+var Format = {
     RFC1738: 'RFC1738',
     RFC3986: 'RFC3986'
 };
+
+module.exports = util.assign(
+    {
+        'default': Format.RFC3986,
+        formatters: {
+            RFC1738: function (value) {
+                return replace.call(value, percentTwenties, '+');
+            },
+            RFC3986: function (value) {
+                return String(value);
+            }
+        }
+    },
+    Format
+);

lib/parse.js

@@ -150,3 +150,3 @@ 'use strict';
 
-    var segment = brackets.exec(key);
+    var segment = options.depth > 0 && brackets.exec(key);
     var parent = segment ? key.slice(0, segment.index) : key;
@@ -171,3 +171,3 @@
     var i = 0;
-    while ((segment = child.exec(key)) !== null && i < options.depth) {
+    while (options.depth > 0 && (segment = child.exec(key)) !== null && i < options.depth) {
         i += 1;
@@ -214,3 +214,4 @@ if (!options.plainObjects && has.call(Object.prototype, segment[1].slice(1, -1))) {
         delimiter: typeof opts.delimiter === 'string' || utils.isRegExp(opts.delimiter) ? opts.delimiter : defaults.delimiter,
-        depth: typeof opts.depth === 'number' ? opts.depth : defaults.depth,
+        // eslint-disable-next-line no-implicit-coercion, no-extra-parens
+        depth: (typeof opts.depth === 'number' || opts.depth === false) ? +opts.depth : defaults.depth,
         ignoreQueryPrefix: opts.ignoreQueryPrefix === true,
@@ -217,0 +218,0 @@ interpretNumericEntities: typeof opts.interpretNumericEntities === 'boolean' ? opts.interpretNumericEntities : defaults.interpretNumericEntities,

lib/stringify.js

@@ -28,2 +28,3 @@ 'use strict';
 
+var defaultFormat = formats['default'];
 var defaults = {
@@ -38,3 +39,4 @@ addQueryPrefix: false,
     encodeValuesOnly: false,
-    formatter: formats.formatters[formats['default']],
+    format: defaultFormat,
+    formatter: formats.formatters[defaultFormat],
     // deprecated
@@ -49,2 +51,10 @@ indices: false,
 
+var isNonNullishPrimitive = function isNonNullishPrimitive(v) { // eslint-disable-line func-name-matching
+    return typeof v === 'string'
+        || typeof v === 'number'
+        || typeof v === 'boolean'
+        || typeof v === 'symbol'
+        || typeof v === 'bigint'; // eslint-disable-line valid-typeof
+};
+
 var stringify = function stringify( // eslint-disable-line func-name-matching
@@ -82,3 +92,3 @@ object,
 
-    if (typeof obj === 'string' || typeof obj === 'number' || typeof obj === 'boolean' || utils.isBuffer(obj)) {
+    if (isNonNullishPrimitive(obj) || utils.isBuffer(obj)) {
         if (encoder) {
@@ -85,0 +95,0 @@ var keyValue = encodeValuesOnly ? prefix : encoder(prefix, defaults.encoder, charset);

lib/utils.js

@@ -129,3 +129,8 @@ 'use strict';
 
-    var string = typeof str === 'string' ? str : String(str);
+    var string = str;
+    if (typeof str === 'symbol') {
+        string = Symbol.prototype.toString.call(str);
+    } else if (typeof str !== 'string') {
+        string = String(str);
+    }
 
@@ -132,0 +137,0 @@ if (charset === 'iso-8859-1') {

package.json

@@ -5,3 +5,3 @@ {
     "homepage": "https://github.com/ljharb/qs",
-    "version": "6.7.0",
+    "version": "6.8.0",
     "repository": {
@@ -32,9 +32,10 @@ "type": "git",
     "devDependencies": {
-        "@ljharb/eslint-config": "^13.1.1",
-        "browserify": "^16.2.3",
+        "@ljharb/eslint-config": "^14.0.2",
+        "browserify": "^16.5.0",
         "covert": "^1.1.1",
-        "editorconfig-tools": "^0.1.1",
-        "eslint": "^5.15.3",
+        "eclint": "^2.8.1",
+        "eslint": "^6.1.0",
         "evalmd": "^0.0.17",
         "for-each": "^0.3.3",
+        "has-symbols": "^1.0.0",
         "iconv-lite": "^0.4.24",
@@ -44,5 +45,5 @@ "mkdirp": "^0.5.1",
         "qs-iconv": "^1.0.4",
-        "safe-publish-latest": "^1.1.2",
+        "safe-publish-latest": "^1.1.3",
         "safer-buffer": "^2.1.2",
-        "tape": "^4.10.1"
+        "tape": "^4.11.0"
     },
@@ -55,3 +56,3 @@ "scripts": {
         "readme": "evalmd README.md",
-        "postlint": "editorconfig-tools check * lib/* test/*",
+        "postlint": "eclint check * lib/* test/*",
         "lint": "eslint lib/*.js test/*.js",
@@ -58,0 +59,0 @@ "coverage": "covert test",

README.md

@@ -556,2 +556,6 @@ # qs <sup>[![Version Badge][2]][1]</sup>
 
+## Security
+
+Please email [@ljharb](https://github.com/ljharb) or see https://tidelift.com/security if you have a potential security vulnerability to report.
+
 [1]: https://npmjs.org/package/qs
@@ -558,0 +562,0 @@ [2]: http://versionbadg.es/ljharb/qs.svg

test/parse.js

@@ -55,2 +55,14 @@ 'use strict';
 
+    t.test('uses original key when depth = 0', function (st) {
+        st.deepEqual(qs.parse('a[0]=b&a[1]=c', { depth: 0 }), { 'a[0]': 'b', 'a[1]': 'c' });
+        st.deepEqual(qs.parse('a[0][0]=b&a[0][1]=c&a[1]=d&e=2', { depth: 0 }), { 'a[0][0]': 'b', 'a[0][1]': 'c', 'a[1]': 'd', e: '2' });
+        st.end();
+    });
+
+    t.test('uses original key when depth = false', function (st) {
+        st.deepEqual(qs.parse('a[0]=b&a[1]=c', { depth: false }), { 'a[0]': 'b', 'a[1]': 'c' });
+        st.deepEqual(qs.parse('a[0][0]=b&a[0][1]=c&a[1]=d&e=2', { depth: false }), { 'a[0][0]': 'b', 'a[0][1]': 'c', 'a[1]': 'd', e: '2' });
+        st.end();
+    });
+
     t.deepEqual(qs.parse('a=b&a=c'), { a: ['b', 'c'] }, 'parses a simple array');
@@ -621,2 +633,3 @@
     t.test('prefers an iso-8859-1 charset specified by the utf8 sentinel to a default charset of utf-8', function (st) {
+        // eslint-disable-next-line quote-props
         st.deepEqual(qs.parse('utf8=' + urlEncodedNumCheckmark + '&' + urlEncodedOSlashInUtf8 + '=' + urlEncodedOSlashInUtf8, { charsetSentinel: true, charset: 'utf-8' }), { 'ø': 'ø' });
@@ -642,2 +655,3 @@ st.end();
     t.test('uses the utf8 sentinel to switch to iso-8859-1 when no default charset is given', function (st) {
+        // eslint-disable-next-line quote-props
         st.deepEqual(qs.parse('utf8=' + urlEncodedNumCheckmark + '&' + urlEncodedOSlashInUtf8 + '=' + urlEncodedOSlashInUtf8, { charsetSentinel: true }), { 'ø': 'ø' });
@@ -644,0 +658,0 @@ st.end();

test/stringify.js

@@ -8,2 +8,4 @@ 'use strict';
 var SaferBuffer = require('safer-buffer').Buffer;
+var hasSymbols = require('has-symbols');
+var hasBigInt = typeof BigInt === 'function';
 
@@ -32,2 +34,35 @@ test('stringify()', function (t) {
 
+    t.test('stringifies symbols', { skip: !hasSymbols() }, function (st) {
+        st.equal(qs.stringify(Symbol.iterator), '');
+        st.equal(qs.stringify([Symbol.iterator]), '0=Symbol%28Symbol.iterator%29');
+        st.equal(qs.stringify({ a: Symbol.iterator }), 'a=Symbol%28Symbol.iterator%29');
+        st.equal(
+            qs.stringify({ a: [Symbol.iterator] }, { encodeValuesOnly: true, arrayFormat: 'brackets' }),
+            'a[]=Symbol%28Symbol.iterator%29'
+        );
+        st.end();
+    });
+
+    t.test('stringifies bigints', { skip: !hasBigInt }, function (st) {
+        var three = BigInt(3); // eslint-disable-line new-cap
+        var encodeWithN = function (value, defaultEncoder, charset) {
+            var result = defaultEncoder(value, defaultEncoder, charset);
+            return typeof value === 'bigint' ? result + 'n' : result; // eslint-disable-line valid-typeof
+        };
+        st.equal(qs.stringify(three), '');
+        st.equal(qs.stringify([three]), '0=3');
+        st.equal(qs.stringify([three], { encoder: encodeWithN }), '0=3n');
+        st.equal(qs.stringify({ a: three }), 'a=3');
+        st.equal(qs.stringify({ a: three }, { encoder: encodeWithN }), 'a=3n');
+        st.equal(
+            qs.stringify({ a: [three] }, { encodeValuesOnly: true, arrayFormat: 'brackets' }),
+            'a[]=3'
+        );
+        st.equal(
+            qs.stringify({ a: [three] }, { encodeValuesOnly: true, encoder: encodeWithN, arrayFormat: 'brackets' }),
+            'a[]=3n'
+        );
+        st.end();
+    });
+
     t.test('adds query prefix', function (st) {
@@ -525,2 +560,8 @@ st.equal(qs.stringify({ a: 'b' }, { addQueryPrefix: true }), '?a=b');
         }), 'a=b');
+
+        st.equal(qs.stringify({ a: SaferBuffer.from('a b') }, {
+            encoder: function (buffer) {
+                return buffer;
+            }
+        }), 'a=a b');
         st.end();
@@ -566,2 +607,3 @@ });
         st.equal(qs.stringify({ 'a b': 'c d' }, { format: qs.formats.RFC1738 }), 'a+b=c+d');
+        st.equal(qs.stringify({ 'a b': SaferBuffer.from('a b') }, { format: qs.formats.RFC1738 }), 'a+b=a+b');
         st.end();
@@ -573,2 +615,3 @@ });
         st.equal(qs.stringify({ 'a b': 'c d' }, { format: qs.formats.RFC3986 }), 'a%20b=c%20d');
+        st.equal(qs.stringify({ 'a b': SaferBuffer.from('a b') }, { format: qs.formats.RFC3986 }), 'a%20b=a%20b');
         st.end();
@@ -579,2 +622,3 @@ });
         st.equal(qs.stringify({ a: 'b c' }), 'a=b%20c');
+        st.equal(qs.stringify({ 'a b': SaferBuffer.from('a b') }), 'a%20b=a%20b');
         st.end();
@@ -581,0 +625,0 @@ });

No alert changes

Improved metrics

Total package byte prevSize

148758

increased by4.09%

Number of package files

19

increased by5.56%

Lines of code

2671

increased by3.69%

Number of lines in readme file

575

increased by0.7%

Worsened metrics

Dev dependency count

15

increased by7.14%

No dependency changes