[fix] parsing comma delimited str with percent encoded comma

ljharb · Oct 18, 2019 · c45429d · c45429d
1 parent f884e2d
commit c45429d
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 6 deletions.
diff --git a/lib/parse.js b/lib/parse.js
@@ -77,17 +77,13 @@ var parseValues = function parseQueryStringValues(str, options) {
             val = options.strictNullHandling ? null : '';
         } else {
             key = options.decoder(part.slice(0, pos), defaults.decoder, charset, 'key');
-            val = options.decoder(part.slice(pos + 1), defaults.decoder, charset, 'value');
+            val = options.decoder(part.slice(pos + 1), defaults.decoder, charset, 'value', options.comma);
         }
 
         if (val && options.interpretNumericEntities && charset === 'iso-8859-1') {
             val = interpretNumericEntities(val);
         }
 
-        if (val && typeof val === 'string' && options.comma && val.indexOf(',') > -1) {
-            val = val.split(',');
-        }
-
         if (part.indexOf('[]=') > -1) {
             val = isArray(val) ? [val] : val;
         }

diff --git a/lib/utils.js b/lib/utils.js
@@ -105,14 +105,19 @@ var assign = function assignSingleSource(target, source) {
     }, target);
 };
 
-var decode = function (str, decoder, charset) {
+var decode = function (str, decoder, charset, key, comma) {
     var strWithoutPlus = str.replace(/\+/g, ' ');
     if (charset === 'iso-8859-1') {
         // unescape never throws, no try...catch needed:
         return strWithoutPlus.replace(/%[0-9a-f]{2}/gi, unescape);
     }
     // utf-8
     try {
+        if (comma && strWithoutPlus.indexOf(',') > -1) {
+            return strWithoutPlus.split(',').map(function (withoutPlusItem) {
+                return decodeURIComponent(withoutPlusItem);
+            });
+        }
         return decodeURIComponent(strWithoutPlus);
     } catch (e) {
         return strWithoutPlus;

diff --git a/test/parse.js b/test/parse.js
@@ -423,6 +423,14 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('parses comma delimited array while having percent-encoded comma treated as normal text', function (st) {
+        st.deepEqual(qs.parse('foo=a%2Cb', { comma: true }), { foo: 'a,b' });
+        st.deepEqual(qs.parse('foo=a%2C%20b,d', { comma: true }), { foo: ['a, b', 'd'] });
+        st.deepEqual(qs.parse('foo=a%2C%20b,c%2C%20d', { comma: true }), { foo: ['a, b', 'c, d'] });
+
+        st.end();
+    });
+
     t.test('parses an object in dot notation', function (st) {
         var input = {
             'user.name': { 'pop[bob]': 3 },