parse.js 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414
  1. 'use strict';
  2. var utils = require('./utils');
  3. var has = Object.prototype.hasOwnProperty;
  4. var isArray = Array.isArray;
  5. var defaults = {
  6. allowDots: false,
  7. allowEmptyArrays: false,
  8. allowPrototypes: false,
  9. allowSparse: false,
  10. arrayLimit: 20,
  11. charset: 'utf-8',
  12. charsetSentinel: false,
  13. comma: false,
  14. decodeDotInKeys: false,
  15. decoder: utils.decode,
  16. delimiter: '&',
  17. depth: 5,
  18. duplicates: 'combine',
  19. ignoreQueryPrefix: false,
  20. interpretNumericEntities: false,
  21. parameterLimit: 1000,
  22. parseArrays: true,
  23. plainObjects: false,
  24. strictDepth: false,
  25. strictMerge: true,
  26. strictNullHandling: false,
  27. throwOnLimitExceeded: false
  28. };
  29. var interpretNumericEntities = function (str) {
  30. return str.replace(/&#(\d+);/g, function ($0, numberStr) {
  31. return String.fromCharCode(parseInt(numberStr, 10));
  32. });
  33. };
  34. var parseArrayValue = function (val, options, currentArrayLength, isFlatArrayValue) {
  35. if (val && typeof val === 'string' && options.comma && val.indexOf(',') > -1) {
  36. if (isFlatArrayValue && options.throwOnLimitExceeded) {
  37. var commaCount = 0;
  38. var commaIndex = val.indexOf(',');
  39. while (commaIndex > -1) {
  40. commaCount += 1;
  41. if (commaCount >= options.arrayLimit) {
  42. throw new RangeError('Array limit exceeded. Only ' + options.arrayLimit + ' element' + (options.arrayLimit === 1 ? '' : 's') + ' allowed in an array.');
  43. }
  44. commaIndex = val.indexOf(',', commaIndex + 1);
  45. }
  46. }
  47. return val.split(',');
  48. }
  49. if (options.throwOnLimitExceeded && currentArrayLength >= options.arrayLimit) {
  50. throw new RangeError('Array limit exceeded. Only ' + options.arrayLimit + ' element' + (options.arrayLimit === 1 ? '' : 's') + ' allowed in an array.');
  51. }
  52. return val;
  53. };
  54. // This is what browsers will submit when the ✓ character occurs in an
  55. // application/x-www-form-urlencoded body and the encoding of the page containing
  56. // the form is iso-8859-1, or when the submitted form has an accept-charset
  57. // attribute of iso-8859-1. Presumably also with other charsets that do not contain
  58. // the ✓ character, such as us-ascii.
  59. var isoSentinel = 'utf8=%26%2310003%3B'; // encodeURIComponent('✓')
  60. // These are the percent-encoded utf-8 octets representing a checkmark, indicating that the request actually is utf-8 encoded.
  61. var charsetSentinel = 'utf8=%E2%9C%93'; // encodeURIComponent('✓')
  62. var parseValues = function parseQueryStringValues(str, options) {
  63. var obj = { __proto__: null };
  64. var cleanStr = options.ignoreQueryPrefix ? str.replace(/^\?/, '') : str;
  65. cleanStr = cleanStr.replace(/%5B/gi, '[').replace(/%5D/gi, ']');
  66. var limit = options.parameterLimit === Infinity ? void undefined : options.parameterLimit;
  67. var parts = cleanStr.split(
  68. options.delimiter,
  69. options.throwOnLimitExceeded && typeof limit !== 'undefined' ? limit + 1 : limit
  70. );
  71. if (options.throwOnLimitExceeded && typeof limit !== 'undefined' && parts.length > limit) {
  72. throw new RangeError('Parameter limit exceeded. Only ' + limit + ' parameter' + (limit === 1 ? '' : 's') + ' allowed.');
  73. }
  74. var skipIndex = -1; // Keep track of where the utf8 sentinel was found
  75. var i;
  76. var charset = options.charset;
  77. if (options.charsetSentinel) {
  78. for (i = 0; i < parts.length; ++i) {
  79. if (parts[i].indexOf('utf8=') === 0) {
  80. if (parts[i] === charsetSentinel) {
  81. charset = 'utf-8';
  82. } else if (parts[i] === isoSentinel) {
  83. charset = 'iso-8859-1';
  84. }
  85. skipIndex = i;
  86. i = parts.length; // The eslint settings do not allow break;
  87. }
  88. }
  89. }
  90. for (i = 0; i < parts.length; ++i) {
  91. if (i === skipIndex) {
  92. continue;
  93. }
  94. var part = parts[i];
  95. var bracketEqualsPos = part.indexOf(']=');
  96. var pos = bracketEqualsPos === -1 ? part.indexOf('=') : bracketEqualsPos + 1;
  97. var key;
  98. var val;
  99. if (pos === -1) {
  100. key = options.decoder(part, defaults.decoder, charset, 'key');
  101. val = options.strictNullHandling ? null : '';
  102. } else {
  103. key = options.decoder(part.slice(0, pos), defaults.decoder, charset, 'key');
  104. if (key !== null) {
  105. val = utils.maybeMap(
  106. parseArrayValue(
  107. part.slice(pos + 1),
  108. options,
  109. isArray(obj[key]) ? obj[key].length : 0,
  110. part.indexOf('[]=') === -1
  111. ),
  112. function (encodedVal) {
  113. return options.decoder(encodedVal, defaults.decoder, charset, 'value');
  114. }
  115. );
  116. }
  117. }
  118. if (val && options.interpretNumericEntities && charset === 'iso-8859-1') {
  119. val = interpretNumericEntities(String(val));
  120. }
  121. if (part.indexOf('[]=') > -1) {
  122. val = isArray(val) ? [val] : val;
  123. }
  124. if (options.comma && isArray(val) && val.length > options.arrayLimit) {
  125. val = utils.combine([], val, options.arrayLimit, options.plainObjects, options.throwOnLimitExceeded);
  126. }
  127. if (key !== null) {
  128. var existing = has.call(obj, key);
  129. if (existing && (options.duplicates === 'combine' || part.indexOf('[]=') > -1)) {
  130. obj[key] = utils.combine(
  131. obj[key],
  132. val,
  133. options.arrayLimit,
  134. options.plainObjects,
  135. options.throwOnLimitExceeded
  136. );
  137. } else if (!existing || options.duplicates === 'last') {
  138. obj[key] = val;
  139. }
  140. }
  141. }
  142. return obj;
  143. };
  144. var parseObject = function (chain, val, options, valuesParsed) {
  145. var currentArrayLength = 0;
  146. if (chain.length > 0 && chain[chain.length - 1] === '[]') {
  147. var parentKey = chain.slice(0, -1).join('');
  148. currentArrayLength = Array.isArray(val) && val[parentKey] ? val[parentKey].length : 0;
  149. }
  150. var leaf = valuesParsed ? val : parseArrayValue(val, options, currentArrayLength);
  151. for (var i = chain.length - 1; i >= 0; --i) {
  152. var obj;
  153. var root = chain[i];
  154. if (root === '[]' && options.parseArrays) {
  155. if (utils.isOverflow(leaf)) {
  156. // leaf is already an overflow object, preserve it
  157. obj = leaf;
  158. } else {
  159. obj = options.allowEmptyArrays && (leaf === '' || (options.strictNullHandling && leaf === null))
  160. ? []
  161. : utils.combine(
  162. [],
  163. leaf,
  164. options.arrayLimit,
  165. options.plainObjects,
  166. options.throwOnLimitExceeded
  167. );
  168. }
  169. } else {
  170. obj = options.plainObjects ? { __proto__: null } : {};
  171. var cleanRoot = root.charAt(0) === '[' && root.charAt(root.length - 1) === ']' ? root.slice(1, -1) : root;
  172. var decodedRoot = options.decodeDotInKeys ? cleanRoot.replace(/%2E/g, '.') : cleanRoot;
  173. var index = parseInt(decodedRoot, 10);
  174. var isValidArrayIndex = !isNaN(index)
  175. && root !== decodedRoot
  176. && String(index) === decodedRoot
  177. && index >= 0
  178. && options.parseArrays;
  179. if (!options.parseArrays && decodedRoot === '') {
  180. obj = { 0: leaf };
  181. } else if (isValidArrayIndex && index < options.arrayLimit) {
  182. obj = [];
  183. obj[index] = leaf;
  184. } else if (isValidArrayIndex && options.throwOnLimitExceeded) {
  185. throw new RangeError('Array limit exceeded. Only ' + options.arrayLimit + ' element' + (options.arrayLimit === 1 ? '' : 's') + ' allowed in an array.');
  186. } else if (isValidArrayIndex) {
  187. obj[index] = leaf;
  188. utils.markOverflow(obj, index);
  189. } else if (decodedRoot !== '__proto__') {
  190. obj[decodedRoot] = leaf;
  191. }
  192. }
  193. leaf = obj;
  194. }
  195. return leaf;
  196. };
  197. // Split a key like "a[b][c[]]" into ['a', '[b]', '[c[]]'] while preserving
  198. // qs parse semantics for depth/prototype guards.
  199. var splitKeyIntoSegments = function splitKeyIntoSegments(originalKey, options) {
  200. var key = options.allowDots ? originalKey.replace(/\.([^.[]+)/g, '[$1]') : originalKey;
  201. // depth <= 0 keeps the whole key as one segment
  202. if (options.depth <= 0) {
  203. if (!options.plainObjects && has.call(Object.prototype, key)) {
  204. if (!options.allowPrototypes) {
  205. return;
  206. }
  207. }
  208. return [key];
  209. }
  210. var segments = [];
  211. // parent before the first '[' (may be empty if key starts with '[')
  212. var first = key.indexOf('[');
  213. var parent = first >= 0 ? key.slice(0, first) : key;
  214. if (parent) {
  215. if (!options.plainObjects && has.call(Object.prototype, parent)) {
  216. if (!options.allowPrototypes) {
  217. return;
  218. }
  219. }
  220. segments[segments.length] = parent;
  221. }
  222. var n = key.length;
  223. var open = first;
  224. var collected = 0;
  225. while (open >= 0 && collected < options.depth) {
  226. var level = 1;
  227. var i = open + 1;
  228. var close = -1;
  229. // balance nested '[' and ']' inside this bracket group using a nesting level counter
  230. while (i < n && close < 0) {
  231. var cu = key.charCodeAt(i);
  232. if (cu === 0x5B) { // '['
  233. level += 1;
  234. } else if (cu === 0x5D) { // ']'
  235. level -= 1;
  236. if (level === 0) {
  237. close = i; // found matching close; loop will exit by condition
  238. }
  239. }
  240. i += 1;
  241. }
  242. if (close < 0) {
  243. // Unterminated group: wrap the raw remainder in one bracket pair so it stays
  244. // a single literal segment (e.g. "[[]b" -> "[[]b]"); we do not infer missing ']'.
  245. segments[segments.length] = '[' + key.slice(open) + ']';
  246. return segments;
  247. }
  248. var seg = key.slice(open, close + 1);
  249. // prototype guard for the content of this group
  250. var content = seg.slice(1, -1);
  251. if (!options.plainObjects && has.call(Object.prototype, content) && !options.allowPrototypes) {
  252. return;
  253. }
  254. segments[segments.length] = seg;
  255. collected += 1;
  256. // find the next '[' after this balanced group
  257. open = key.indexOf('[', close + 1);
  258. }
  259. if (open >= 0) {
  260. if (options.strictDepth === true) {
  261. throw new RangeError('Input depth exceeded depth option of ' + options.depth + ' and strictDepth is true');
  262. }
  263. segments[segments.length] = '[' + key.slice(open) + ']';
  264. }
  265. return segments;
  266. };
  267. var parseKeys = function parseQueryStringKeys(givenKey, val, options, valuesParsed) {
  268. if (!givenKey) {
  269. return;
  270. }
  271. var keys = splitKeyIntoSegments(givenKey, options);
  272. if (!keys) {
  273. return;
  274. }
  275. return parseObject(keys, val, options, valuesParsed);
  276. };
  277. var normalizeParseOptions = function normalizeParseOptions(opts) {
  278. if (!opts) {
  279. return defaults;
  280. }
  281. if (typeof opts.allowEmptyArrays !== 'undefined' && typeof opts.allowEmptyArrays !== 'boolean') {
  282. throw new TypeError('`allowEmptyArrays` option can only be `true` or `false`, when provided');
  283. }
  284. if (typeof opts.decodeDotInKeys !== 'undefined' && typeof opts.decodeDotInKeys !== 'boolean') {
  285. throw new TypeError('`decodeDotInKeys` option can only be `true` or `false`, when provided');
  286. }
  287. if (opts.decoder !== null && typeof opts.decoder !== 'undefined' && typeof opts.decoder !== 'function') {
  288. throw new TypeError('Decoder has to be a function.');
  289. }
  290. if (typeof opts.charset !== 'undefined' && opts.charset !== 'utf-8' && opts.charset !== 'iso-8859-1') {
  291. throw new TypeError('The charset option must be either utf-8, iso-8859-1, or undefined');
  292. }
  293. if (typeof opts.throwOnLimitExceeded !== 'undefined' && typeof opts.throwOnLimitExceeded !== 'boolean') {
  294. throw new TypeError('`throwOnLimitExceeded` option must be a boolean');
  295. }
  296. var charset = typeof opts.charset === 'undefined' ? defaults.charset : opts.charset;
  297. var duplicates = typeof opts.duplicates === 'undefined' ? defaults.duplicates : opts.duplicates;
  298. if (duplicates !== 'combine' && duplicates !== 'first' && duplicates !== 'last') {
  299. throw new TypeError('The duplicates option must be either combine, first, or last');
  300. }
  301. var allowDots = typeof opts.allowDots === 'undefined' ? opts.decodeDotInKeys === true ? true : defaults.allowDots : !!opts.allowDots;
  302. return {
  303. allowDots: allowDots,
  304. allowEmptyArrays: typeof opts.allowEmptyArrays === 'boolean' ? !!opts.allowEmptyArrays : defaults.allowEmptyArrays,
  305. allowPrototypes: typeof opts.allowPrototypes === 'boolean' ? opts.allowPrototypes : defaults.allowPrototypes,
  306. allowSparse: typeof opts.allowSparse === 'boolean' ? opts.allowSparse : defaults.allowSparse,
  307. arrayLimit: typeof opts.arrayLimit === 'number' ? opts.arrayLimit : defaults.arrayLimit,
  308. charset: charset,
  309. charsetSentinel: typeof opts.charsetSentinel === 'boolean' ? opts.charsetSentinel : defaults.charsetSentinel,
  310. comma: typeof opts.comma === 'boolean' ? opts.comma : defaults.comma,
  311. decodeDotInKeys: typeof opts.decodeDotInKeys === 'boolean' ? opts.decodeDotInKeys : defaults.decodeDotInKeys,
  312. decoder: typeof opts.decoder === 'function' ? opts.decoder : defaults.decoder,
  313. delimiter: typeof opts.delimiter === 'string' || utils.isRegExp(opts.delimiter) ? opts.delimiter : defaults.delimiter,
  314. // eslint-disable-next-line no-implicit-coercion, no-extra-parens
  315. depth: (typeof opts.depth === 'number' || opts.depth === false) ? +opts.depth : defaults.depth,
  316. duplicates: duplicates,
  317. ignoreQueryPrefix: opts.ignoreQueryPrefix === true,
  318. interpretNumericEntities: typeof opts.interpretNumericEntities === 'boolean' ? opts.interpretNumericEntities : defaults.interpretNumericEntities,
  319. parameterLimit: typeof opts.parameterLimit === 'number' ? opts.parameterLimit : defaults.parameterLimit,
  320. parseArrays: opts.parseArrays !== false,
  321. plainObjects: typeof opts.plainObjects === 'boolean' ? opts.plainObjects : defaults.plainObjects,
  322. strictDepth: typeof opts.strictDepth === 'boolean' ? !!opts.strictDepth : defaults.strictDepth,
  323. strictMerge: typeof opts.strictMerge === 'boolean' ? !!opts.strictMerge : defaults.strictMerge,
  324. strictNullHandling: typeof opts.strictNullHandling === 'boolean' ? opts.strictNullHandling : defaults.strictNullHandling,
  325. throwOnLimitExceeded: typeof opts.throwOnLimitExceeded === 'boolean' ? opts.throwOnLimitExceeded : false
  326. };
  327. };
  328. module.exports = function (str, opts) {
  329. var options = normalizeParseOptions(opts);
  330. if (str === '' || str === null || typeof str === 'undefined') {
  331. return options.plainObjects ? { __proto__: null } : {};
  332. }
  333. var tempObj = typeof str === 'string' ? parseValues(str, options) : str;
  334. var obj = options.plainObjects ? { __proto__: null } : {};
  335. // Iterate over the keys and setup the new object
  336. var keys = Object.keys(tempObj);
  337. for (var i = 0; i < keys.length; ++i) {
  338. var key = keys[i];
  339. var newObj = parseKeys(key, tempObj[key], options, typeof str === 'string');
  340. obj = utils.merge(obj, newObj, options);
  341. }
  342. if (options.allowSparse === true) {
  343. return obj;
  344. }
  345. return utils.compact(obj);
  346. };