From c45429d4c78b1d82655aaccd187a123fb1916859 Mon Sep 17 00:00:00 2001
From: Mohamed Omar <mohamed.ahmed.c209@gmail.com>
Date: Fri, 18 Oct 2019 19:41:30 +0200
Subject: [PATCH] [fix] parsing comma delimited str with percent encoded comma

---
 lib/parse.js  | 6 +-----
 lib/utils.js  | 7 ++++++-
 test/parse.js | 8 ++++++++
 3 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/lib/parse.js b/lib/parse.js
index 7cca8842..2c93eb6b 100644
--- a/lib/parse.js
+++ b/lib/parse.js
@@ -77,17 +77,13 @@ var parseValues = function parseQueryStringValues(str, options) {
             val = options.strictNullHandling ? null : '';
         } else {
             key = options.decoder(part.slice(0, pos), defaults.decoder, charset, 'key');
-            val = options.decoder(part.slice(pos + 1), defaults.decoder, charset, 'value');
+            val = options.decoder(part.slice(pos + 1), defaults.decoder, charset, 'value', options.comma);
         }
 
         if (val && options.interpretNumericEntities && charset === 'iso-8859-1') {
             val = interpretNumericEntities(val);
         }
 
-        if (val && typeof val === 'string' && options.comma && val.indexOf(',') > -1) {
-            val = val.split(',');
-        }
-
         if (part.indexOf('[]=') > -1) {
             val = isArray(val) ? [val] : val;
         }
diff --git a/lib/utils.js b/lib/utils.js
index f3260633..ca2abd08 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -105,7 +105,7 @@ var assign = function assignSingleSource(target, source) {
     }, target);
 };
 
-var decode = function (str, decoder, charset) {
+var decode = function (str, decoder, charset, key, comma) {
     var strWithoutPlus = str.replace(/\+/g, ' ');
     if (charset === 'iso-8859-1') {
         // unescape never throws, no try...catch needed:
@@ -113,6 +113,11 @@ var decode = function (str, decoder, charset) {
     }
     // utf-8
     try {
+        if (comma && strWithoutPlus.indexOf(',') > -1) {
+            return strWithoutPlus.split(',').map(function (withoutPlusItem) {
+                return decodeURIComponent(withoutPlusItem);
+            });
+        }
         return decodeURIComponent(strWithoutPlus);
     } catch (e) {
         return strWithoutPlus;
diff --git a/test/parse.js b/test/parse.js
index be10400b..21d20e13 100644
--- a/test/parse.js
+++ b/test/parse.js
@@ -423,6 +423,14 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('parses comma delimited array while having percent-encoded comma treated as normal text', function (st) {
+        st.deepEqual(qs.parse('foo=a%2Cb', { comma: true }), { foo: 'a,b' });
+        st.deepEqual(qs.parse('foo=a%2C%20b,d', { comma: true }), { foo: ['a, b', 'd'] });
+        st.deepEqual(qs.parse('foo=a%2C%20b,c%2C%20d', { comma: true }), { foo: ['a, b', 'c, d'] });
+
+        st.end();
+    });
+
     t.test('parses an object in dot notation', function (st) {
         var input = {
             'user.name': { 'pop[bob]': 3 },