Skip to content

Commit 9804e24

Browse files
AlessioGrAlessioGr
authored
fix: ensure arrayLength applies to [] notation as well
1 parent 90bbdb5 commit 9804e24

File tree

4 files changed

+301
-10
lines changed

4 files changed

+301
-10
lines changed

‎lib/parse.js‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,12 @@ const parseValues = function parseQueryStringValues(str, options) {
105105

106106
const existing = has.call(obj, key)
107107
if (existing && options.duplicates === 'combine') {
108-
obj[key] = utils.combine(obj[key], val)
108+
obj[key] = utils.combine(
109+
obj[key],
110+
val,
111+
options.arrayLimit,
112+
options.plainObjects
113+
);
109114
} else if (!existing || options.duplicates === 'last') {
110115
obj[key] = val
111116
}
@@ -122,7 +127,19 @@ const parseObject = function (chain, val, options, valuesParsed) {
122127
const root = chain[i]
123128

124129
if (root === '[]' && options.parseArrays) {
125-
obj = options.allowEmptyArrays && leaf === '' ? [] : [].concat(leaf)
130+
if (utils.isOverflow(leaf)) {
131+
// leaf is already an overflow object, preserve it
132+
obj = leaf;
133+
} else {
134+
obj = options.allowEmptyArrays && (leaf === '' || (options.strictNullHandling && leaf === null))
135+
? []
136+
: utils.combine(
137+
[],
138+
leaf,
139+
options.arrayLimit,
140+
options.plainObjects
141+
);
142+
}
126143
} else {
127144
obj = options.plainObjects ? Object.create(null) : {}
128145
const cleanRoot =

‎lib/utils.js‎

Lines changed: 53 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,26 @@ import * as formats from './formats.js'
55
const has = Object.prototype.hasOwnProperty
66
const isArray = Array.isArray
77

8+
const overflowChannel = new WeakMap();
9+
10+
var markOverflow = function markOverflow(obj, maxIndex) {
11+
overflowChannel.set(obj, maxIndex);
12+
return obj;
13+
};
14+
15+
export function isOverflow(obj) {
16+
return overflowChannel.has(obj);
17+
};
18+
19+
var getMaxIndex = function getMaxIndex(obj) {
20+
return overflowChannel.get(obj);
21+
};
22+
23+
var setMaxIndex = function setMaxIndex(obj, maxIndex) {
24+
overflowChannel.set(obj, maxIndex);
25+
};
26+
27+
828
const hexTable = (function () {
929
const array = []
1030
for (let i = 0; i < 256; ++i) {
@@ -54,7 +74,12 @@ export const merge = function merge(target, source, options) {
5474
if (isArray(target)) {
5575
target.push(source)
5676
} else if (target && typeof target === 'object') {
57-
if (
77+
if (isOverflow(target)) {
78+
// Add at next numeric index for overflow objects
79+
var newIndex = getMaxIndex(target) + 1;
80+
target[newIndex] = source;
81+
setMaxIndex(target, newIndex);
82+
} else if (
5883
(options && (options.plainObjects || options.allowPrototypes)) ||
5984
!has.call(Object.prototype, source)
6085
) {
@@ -68,6 +93,18 @@ export const merge = function merge(target, source, options) {
6893
}
6994

7095
if (!target || typeof target !== 'object') {
96+
if (isOverflow(source)) {
97+
// Create new object with target at 0, source values shifted by 1
98+
var sourceKeys = Object.keys(source);
99+
var result = options && options.plainObjects
100+
? { __proto__: null, 0: target }
101+
: { 0: target };
102+
for (var m = 0; m < sourceKeys.length; m++) {
103+
var oldKey = parseInt(sourceKeys[m], 10);
104+
result[oldKey + 1] = source[sourceKeys[m]];
105+
}
106+
return markOverflow(result, getMaxIndex(source) + 1);
107+
}
71108
return [target].concat(source)
72109
}
73110

@@ -238,9 +275,21 @@ export const isBuffer = function isBuffer(obj) {
238275
return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj))
239276
}
240277

241-
export const combine = function combine(a, b) {
242-
return [].concat(a, b)
243-
}
278+
export const combine = function combine(a, b, arrayLimit, plainObjects) {
279+
// If 'a' is already an overflow object, add to it
280+
if (isOverflow(a)) {
281+
var newIndex = getMaxIndex(a) + 1;
282+
a[newIndex] = b;
283+
setMaxIndex(a, newIndex);
284+
return a;
285+
}
286+
287+
var result = [].concat(a, b);
288+
if (result.length > arrayLimit) {
289+
return markOverflow(arrayToObject(result, { plainObjects: plainObjects }), result.length - 1);
290+
}
291+
return result;
292+
};
244293

245294
export const maybeMap = function maybeMap(val, fn) {
246295
if (isArray(val)) {

‎test/parse.cjs‎

Lines changed: 110 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -246,11 +246,11 @@ test('parse()', async function (t) {
246246
st.deepEqual(qs.parse('a=b&a[0]=c'), { a: ['b', 'c'] })
247247

248248
st.deepEqual(qs.parse('a[1]=b&a=c', { arrayLimit: 20 }), { a: ['b', 'c'] })
249-
st.deepEqual(qs.parse('a[]=b&a=c', { arrayLimit: 0 }), { a: ['b', 'c'] })
249+
st.deepEqual(qs.parse('a[]=b&a=c', { arrayLimit: 0 }), { a: { 0: 'b', 1: 'c' } });
250250
st.deepEqual(qs.parse('a[]=b&a=c'), { a: ['b', 'c'] })
251251

252252
st.deepEqual(qs.parse('a=b&a[1]=c', { arrayLimit: 20 }), { a: ['b', 'c'] })
253-
st.deepEqual(qs.parse('a=b&a[]=c', { arrayLimit: 0 }), { a: ['b', 'c'] })
253+
st.deepEqual(qs.parse('a=b&a[]=c', { arrayLimit: 0 }), { a: { 0: 'b', 1: 'c' } });
254254
st.deepEqual(qs.parse('a=b&a[]=c'), { a: ['b', 'c'] })
255255

256256
st.end()
@@ -416,7 +416,7 @@ test('parse()', async function (t) {
416416
)
417417
st.deepEqual(
418418
qs.parse('a[]=b&a[]&a[]=c&a[]=', { strictNullHandling: true, arrayLimit: 0 }),
419-
{ a: ['b', null, 'c', ''] },
419+
{ a: { 0: 'b', 1: null, 2: 'c', 3: '' } },
420420
'with arrayLimit 0 + array brackets: null then empty string works',
421421
)
422422

@@ -427,7 +427,7 @@ test('parse()', async function (t) {
427427
)
428428
st.deepEqual(
429429
qs.parse('a[]=b&a[]=&a[]=c&a[]', { strictNullHandling: true, arrayLimit: 0 }),
430-
{ a: ['b', '', 'c', null] },
430+
{ a: { 0: 'b', 1: '', 2: 'c', 3: null } },
431431
'with arrayLimit 0 + array brackets: empty string then null works',
432432
)
433433

@@ -1210,6 +1210,112 @@ test('parse()', async function (t) {
12101210
st.end()
12111211
})
12121212

1213+
test('DOS', function (t) {
1214+
var arr = [];
1215+
for (var i = 0; i < 105; i++) {
1216+
arr[arr.length] = 'x';
1217+
}
1218+
var attack = 'a[]=' + arr.join('&a[]=');
1219+
var result = qs.parse(attack, { arrayLimit: 100 });
1220+
1221+
t.notOk(Array.isArray(result.a), 'arrayLimit is respected: result is an object, not an array');
1222+
t.equal(Object.keys(result.a).length, 105, 'all values are preserved');
1223+
1224+
t.end();
1225+
});
1226+
1227+
test('arrayLimit boundary conditions', function (t) {
1228+
t.test('exactly at the limit stays as array', function (st) {
1229+
var result = qs.parse('a[]=1&a[]=2&a[]=3', { arrayLimit: 3 });
1230+
st.ok(Array.isArray(result.a), 'result is an array when exactly at limit');
1231+
st.deepEqual(result.a, ['1', '2', '3'], 'all values present');
1232+
st.end();
1233+
});
1234+
1235+
t.test('one over the limit converts to object', function (st) {
1236+
var result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4', { arrayLimit: 3 });
1237+
st.notOk(Array.isArray(result.a), 'result is not an array when over limit');
1238+
st.deepEqual(result.a, { 0: '1', 1: '2', 2: '3', 3: '4' }, 'all values preserved as object');
1239+
st.end();
1240+
});
1241+
1242+
t.test('arrayLimit 1 with two values', function (st) {
1243+
var result = qs.parse('a[]=1&a[]=2', { arrayLimit: 1 });
1244+
st.notOk(Array.isArray(result.a), 'result is not an array');
1245+
st.deepEqual(result.a, { 0: '1', 1: '2' }, 'both values preserved');
1246+
st.end();
1247+
});
1248+
1249+
t.end();
1250+
});
1251+
1252+
test('mixed array and object notation', function (t) {
1253+
t.test('array brackets with object key - under limit', function (st) {
1254+
st.deepEqual(
1255+
qs.parse('a[]=b&a[c]=d'),
1256+
{ a: { 0: 'b', c: 'd' } },
1257+
'mixing [] and [key] converts to object'
1258+
);
1259+
st.end();
1260+
});
1261+
1262+
t.test('array index with object key - under limit', function (st) {
1263+
st.deepEqual(
1264+
qs.parse('a[0]=b&a[c]=d'),
1265+
{ a: { 0: 'b', c: 'd' } },
1266+
'mixing [0] and [key] produces object'
1267+
);
1268+
st.end();
1269+
});
1270+
1271+
t.test('plain value with array brackets - under limit', function (st) {
1272+
st.deepEqual(
1273+
qs.parse('a=b&a[]=c', { arrayLimit: 20 }),
1274+
{ a: ['b', 'c'] },
1275+
'plain value combined with [] stays as array under limit'
1276+
);
1277+
st.end();
1278+
});
1279+
1280+
t.test('array brackets with plain value - under limit', function (st) {
1281+
st.deepEqual(
1282+
qs.parse('a[]=b&a=c', { arrayLimit: 20 }),
1283+
{ a: ['b', 'c'] },
1284+
'[] combined with plain value stays as array under limit'
1285+
);
1286+
st.end();
1287+
});
1288+
1289+
t.test('plain value with array index - under limit', function (st) {
1290+
st.deepEqual(
1291+
qs.parse('a=b&a[0]=c', { arrayLimit: 20 }),
1292+
{ a: ['b', 'c'] },
1293+
'plain value combined with [0] stays as array under limit'
1294+
);
1295+
st.end();
1296+
});
1297+
1298+
t.test('multiple plain values with duplicates combine', function (st) {
1299+
st.deepEqual(
1300+
qs.parse('a=b&a=c&a=d', { arrayLimit: 20 }),
1301+
{ a: ['b', 'c', 'd'] },
1302+
'duplicate plain keys combine into array'
1303+
);
1304+
st.end();
1305+
});
1306+
1307+
t.test('multiple plain values exceeding limit', function (st) {
1308+
st.deepEqual(
1309+
qs.parse('a=b&a=c&a=d', { arrayLimit: 2 }),
1310+
{ a: { 0: 'b', 1: 'c', 2: 'd' } },
1311+
'duplicate plain keys convert to object when exceeding limit'
1312+
);
1313+
st.end();
1314+
});
1315+
1316+
t.end();
1317+
});
1318+
12131319
t.end()
12141320
})
12151321

‎test/utils.cjs‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,60 @@ test('merge()', async function (t) {
7070
},
7171
)
7272

73+
t.test('with overflow objects (from arrayLimit)', function (st) {
74+
st.test('merges primitive into overflow object at next index', function (s2t) {
75+
// Create an overflow object via combine
76+
var overflow = utils.combine(['a'], 'b', 1, false);
77+
s2t.ok(utils.isOverflow(overflow), 'overflow object is marked');
78+
var merged = utils.merge(overflow, 'c');
79+
s2t.deepEqual(merged, { 0: 'a', 1: 'b', 2: 'c' }, 'adds primitive at next numeric index');
80+
s2t.end();
81+
});
82+
83+
st.test('merges primitive into regular object with numeric keys normally', function (s2t) {
84+
var obj = { 0: 'a', 1: 'b' };
85+
s2t.notOk(utils.isOverflow(obj), 'plain object is not marked as overflow');
86+
var merged = utils.merge(obj, 'c');
87+
s2t.deepEqual(merged, { 0: 'a', 1: 'b', c: true }, 'adds primitive as key (not at next index)');
88+
s2t.end();
89+
});
90+
91+
st.test('merges primitive into object with non-numeric keys normally', function (s2t) {
92+
var obj = { foo: 'bar' };
93+
var merged = utils.merge(obj, 'baz');
94+
s2t.deepEqual(merged, { foo: 'bar', baz: true }, 'adds primitive as key with value true');
95+
s2t.end();
96+
});
97+
98+
st.test('merges overflow object into primitive', function (s2t) {
99+
// Create an overflow object via combine
100+
var overflow = utils.combine([], 'b', 0, false);
101+
s2t.ok(utils.isOverflow(overflow), 'overflow object is marked');
102+
var merged = utils.merge('a', overflow);
103+
s2t.ok(utils.isOverflow(merged), 'result is also marked as overflow');
104+
s2t.deepEqual(merged, { 0: 'a', 1: 'b' }, 'creates object with primitive at 0, source values shifted');
105+
s2t.end();
106+
});
107+
108+
st.test('merges overflow object with multiple values into primitive', function (s2t) {
109+
// Create an overflow object via combine
110+
var overflow = utils.combine(['b'], 'c', 1, false);
111+
s2t.ok(utils.isOverflow(overflow), 'overflow object is marked');
112+
var merged = utils.merge('a', overflow);
113+
s2t.deepEqual(merged, { 0: 'a', 1: 'b', 2: 'c' }, 'shifts all source indices by 1');
114+
s2t.end();
115+
});
116+
117+
st.test('merges regular object into primitive as array', function (s2t) {
118+
var obj = { foo: 'bar' };
119+
var merged = utils.merge('a', obj);
120+
s2t.deepEqual(merged, ['a', { foo: 'bar' }], 'creates array with primitive and object');
121+
s2t.end();
122+
});
123+
124+
st.end();
125+
});
126+
73127
t.end()
74128
})
75129

@@ -136,6 +190,71 @@ test('combine()', async function (t) {
136190
st.end()
137191
})
138192

193+
t.test('with arrayLimit', function (st) {
194+
st.test('under the limit', function (s2t) {
195+
var combined = utils.combine(['a', 'b'], 'c', 10, false);
196+
s2t.deepEqual(combined, ['a', 'b', 'c'], 'returns array when under limit');
197+
s2t.ok(Array.isArray(combined), 'result is an array');
198+
s2t.end();
199+
});
200+
201+
st.test('exactly at the limit stays as array', function (s2t) {
202+
var combined = utils.combine(['a', 'b'], 'c', 3, false);
203+
s2t.deepEqual(combined, ['a', 'b', 'c'], 'stays as array when exactly at limit');
204+
s2t.ok(Array.isArray(combined), 'result is an array');
205+
s2t.end();
206+
});
207+
208+
st.test('over the limit', function (s2t) {
209+
var combined = utils.combine(['a', 'b', 'c'], 'd', 3, false);
210+
s2t.deepEqual(combined, { 0: 'a', 1: 'b', 2: 'c', 3: 'd' }, 'converts to object when over limit');
211+
s2t.notOk(Array.isArray(combined), 'result is not an array');
212+
s2t.end();
213+
});
214+
215+
st.test('with arrayLimit 0', function (s2t) {
216+
var combined = utils.combine([], 'a', 0, false);
217+
s2t.deepEqual(combined, { 0: 'a' }, 'converts single element to object with arrayLimit 0');
218+
s2t.notOk(Array.isArray(combined), 'result is not an array');
219+
s2t.end();
220+
});
221+
222+
st.test('with plainObjects option', function (s2t) {
223+
var combined = utils.combine(['a'], 'b', 1, true);
224+
var expected = { __proto__: null, 0: 'a', 1: 'b' };
225+
s2t.deepEqual(combined, expected, 'converts to object with null prototype');
226+
s2t.equal(Object.getPrototypeOf(combined), null, 'result has null prototype when plainObjects is true');
227+
s2t.end();
228+
});
229+
230+
st.end();
231+
});
232+
233+
t.test('with existing overflow object', function (st) {
234+
st.test('adds to existing overflow object at next index', function (s2t) {
235+
// Create overflow object first via combine
236+
var overflow = utils.combine(['a'], 'b', 1, false);
237+
s2t.ok(utils.isOverflow(overflow), 'initial object is marked as overflow');
238+
239+
var combined = utils.combine(overflow, 'c', 10, false);
240+
s2t.equal(combined, overflow, 'returns the same object (mutated)');
241+
s2t.deepEqual(combined, { 0: 'a', 1: 'b', 2: 'c' }, 'adds value at next numeric index');
242+
s2t.end();
243+
});
244+
245+
st.test('does not treat plain object with numeric keys as overflow', function (s2t) {
246+
var plainObj = { 0: 'a', 1: 'b' };
247+
s2t.notOk(utils.isOverflow(plainObj), 'plain object is not marked as overflow');
248+
249+
// combine treats this as a regular value, not an overflow object to append to
250+
var combined = utils.combine(plainObj, 'c', 10, false);
251+
s2t.deepEqual(combined, [{ 0: 'a', 1: 'b' }, 'c'], 'concatenates as regular values');
252+
s2t.end();
253+
});
254+
255+
st.end();
256+
});
257+
139258
t.end()
140259
})
141260

0 commit comments

Comments
 (0)