Merge pull request #814 from AikidoSec/empty-strings

Don't add empty strings to the context

Author: hansott

library/helpers/extractStringsFromUserInput.test.ts

@@ -10,6 +10,10 @@ t.test("empty object returns empty array", async () => {
   t.same(extractStringsFromUserInput({}), fromArr([]));
 });
 
+t.test("empty strings are ignored", async () => {
+  t.same(extractStringsFromUserInput({ abc: "" }), fromArr(["abc"]));
+});
+
 t.test("it can extract query objects", async () => {
   t.same(
     extractStringsFromUserInput({ age: { $gt: "21" } }),

library/helpers/extractStringsFromUserInput.ts

@@ -42,7 +42,7 @@ export function extractStringsFromUserInput(
     results.add(obj.join());
   }
 
-  if (typeof obj === "string") {
+  if (typeof obj === "string" && obj.length > 0) {
     results.add(obj);
 
     if (obj.includes("%") && obj.length >= 3) {