@@ -530,6 +530,66 @@ test('parse()', function (t) {
530
530
st . end ( ) ;
531
531
} ) ;
532
532
533
+ t . test ( 'dunder proto is ignored' , function ( st ) {
534
+ var payload = 'categories[__proto__]=login&categories[__proto__]&categories[length]=42' ;
535
+ var result = qs . parse ( payload , { allowPrototypes : true } ) ;
536
+
537
+ st . deepEqual (
538
+ result ,
539
+ {
540
+ categories : {
541
+ length : '42'
542
+ }
543
+ } ,
544
+ 'silent [[Prototype]] payload'
545
+ ) ;
546
+
547
+ var plainResult = qs . parse ( payload , { allowPrototypes : true , plainObjects : true } ) ;
548
+
549
+ st . deepEqual (
550
+ plainResult ,
551
+ {
552
+ __proto__ : null ,
553
+ categories : {
554
+ __proto__ : null ,
555
+ length : '42'
556
+ }
557
+ } ,
558
+ 'silent [[Prototype]] payload: plain objects'
559
+ ) ;
560
+
561
+ var query = qs . parse ( 'categories[__proto__]=cats&categories[__proto__]=dogs&categories[some][json]=toInject' , { allowPrototypes : true } ) ;
562
+
563
+ st . notOk ( Array . isArray ( query . categories ) , 'is not an array' ) ;
564
+ st . notOk ( query . categories instanceof Array , 'is not instanceof an array' ) ;
565
+ st . deepEqual ( query . categories , { some : { json : 'toInject' } } ) ;
566
+ st . equal ( JSON . stringify ( query . categories ) , '{"some":{"json":"toInject"}}' , 'stringifies as a non-array' ) ;
567
+
568
+ st . deepEqual (
569
+ qs . parse ( 'foo[__proto__][hidden]=value&foo[bar]=stuffs' , { allowPrototypes : true } ) ,
570
+ {
571
+ foo : {
572
+ bar : 'stuffs'
573
+ }
574
+ } ,
575
+ 'hidden values'
576
+ ) ;
577
+
578
+ st . deepEqual (
579
+ qs . parse ( 'foo[__proto__][hidden]=value&foo[bar]=stuffs' , { allowPrototypes : true , plainObjects : true } ) ,
580
+ {
581
+ __proto__ : null ,
582
+ foo : {
583
+ __proto__ : null ,
584
+ bar : 'stuffs'
585
+ }
586
+ } ,
587
+ 'hidden values: plain objects'
588
+ ) ;
589
+
590
+ st . end ( ) ;
591
+ } ) ;
592
+
533
593
t . test ( 'can return null objects' , { skip : ! Object . create } , function ( st ) {
534
594
var expected = Object . create ( null ) ;
535
595
expected . a = Object . create ( null ) ;
0 commit comments