Skip to content

Commit ed0f5dc

Browse files
committed
[Fix] parse: ignore __proto__ keys (#428)
1 parent 691e739 commit ed0f5dc

File tree

2 files changed

+61
-1
lines changed

2 files changed

+61
-1
lines changed

lib/parse.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ var parseObject = function (chain, val, options) {
7070
) {
7171
obj = [];
7272
obj[index] = leaf;
73-
} else {
73+
} else if (cleanRoot !== '__proto__') {
7474
obj[cleanRoot] = leaf;
7575
}
7676
}

test/parse.js

+60
Original file line numberDiff line numberDiff line change
@@ -530,6 +530,66 @@ test('parse()', function (t) {
530530
st.end();
531531
});
532532

533+
t.test('dunder proto is ignored', function (st) {
534+
var payload = 'categories[__proto__]=login&categories[__proto__]&categories[length]=42';
535+
var result = qs.parse(payload, { allowPrototypes: true });
536+
537+
st.deepEqual(
538+
result,
539+
{
540+
categories: {
541+
length: '42'
542+
}
543+
},
544+
'silent [[Prototype]] payload'
545+
);
546+
547+
var plainResult = qs.parse(payload, { allowPrototypes: true, plainObjects: true });
548+
549+
st.deepEqual(
550+
plainResult,
551+
{
552+
__proto__: null,
553+
categories: {
554+
__proto__: null,
555+
length: '42'
556+
}
557+
},
558+
'silent [[Prototype]] payload: plain objects'
559+
);
560+
561+
var query = qs.parse('categories[__proto__]=cats&categories[__proto__]=dogs&categories[some][json]=toInject', { allowPrototypes: true });
562+
563+
st.notOk(Array.isArray(query.categories), 'is not an array');
564+
st.notOk(query.categories instanceof Array, 'is not instanceof an array');
565+
st.deepEqual(query.categories, { some: { json: 'toInject' } });
566+
st.equal(JSON.stringify(query.categories), '{"some":{"json":"toInject"}}', 'stringifies as a non-array');
567+
568+
st.deepEqual(
569+
qs.parse('foo[__proto__][hidden]=value&foo[bar]=stuffs', { allowPrototypes: true }),
570+
{
571+
foo: {
572+
bar: 'stuffs'
573+
}
574+
},
575+
'hidden values'
576+
);
577+
578+
st.deepEqual(
579+
qs.parse('foo[__proto__][hidden]=value&foo[bar]=stuffs', { allowPrototypes: true, plainObjects: true }),
580+
{
581+
__proto__: null,
582+
foo: {
583+
__proto__: null,
584+
bar: 'stuffs'
585+
}
586+
},
587+
'hidden values: plain objects'
588+
);
589+
590+
st.end();
591+
});
592+
533593
t.test('can return null objects', { skip: !Object.create }, function (st) {
534594
var expected = Object.create(null);
535595
expected.a = Object.create(null);

0 commit comments

Comments
 (0)