-
-
Notifications
You must be signed in to change notification settings - Fork 869
Description
With duplicates set to 'combine' (default) parseArrays: false can parse some query strings as arrays. The readme says:
Lines 313 to 318 in 6bdfaf5
| To disable array parsing entirely, set `parseArrays` to `false`. | |
| ```javascript | |
| var noParsingArrays = qs.parse('a[]=b', { parseArrays: false }); | |
| assert.deepEqual(noParsingArrays, { a: { '0': 'b' } }); | |
| ``` |
To me it suggests that with this option disabled I should never get an array. Other interpretation could be that this applies only to a[] and a[0] notations, since the "Parsing arrays" section mentions only those two notations and parsing repeating keys as arrays is mentioned only in the duplicates section (counter point: the test for a=b&a=c was literally called a simple array test in one of the first commits to this repository - 622da20).
On the current main (6bdfaf5) (should be same in 16.4.1) and 16.4.0 I see the following behaviour:
| query | arrayLimit |
parseArrays |
result - 6bdfaf5 | result - 16.4.0 |
|---|---|---|---|---|
a=b&a=c |
Infinity | false |
{ a: [ 'b', 'c' ] } |
{ a: [ 'b', 'c' ] } |
a[]=b&a[]=c |
Infinity | false |
{ a: { '0': [ 'b', 'c' ] } } |
{ a: { '0': [ 'b', 'c' ] } } |
a=b&a=c |
Infinity | true |
{ a: [ 'b', 'c' ] } |
{ a: [ 'b', 'c' ] } |
a[]=b&a[]=c |
Infinity | true |
{ a: [ 'b', 'c' ] } |
{ a: [ 'b', 'c' ] } |
a=b&a=c |
-1 | false |
{ a: { '0': 'b', '1': 'c' } } |
{ a: [ 'b', 'c' ] } |
a[]=b&a[]=c |
-1 | false |
{ a: { '0': { '0': 'b', '1': 'c' } } } |
{ a: { '0': [ 'b', 'c' ] } } |
a=b&a=c |
-1 | true |
{ a: { '0': 'b', '1': 'c' } } |
{ a: [ 'b', 'c' ] } |
a[]=b&a[]=c |
-1 | true |
{ a: { '0': 'b', '1': 'c' } } |
{ a: [ 'b', 'c' ] } |
This is not what I would expect based on the documentation (readme), but I think I may know the historical reason for this behaviour. arrayLimit was intended (until 16.4.1) to restrict only arrays with explicit indexes (see 4667c41, 8c5cda3, #294 and a longer analysis in #537 (comment)) and I believe parseArrays: false was meant to replace arrayLimit: -1 (#60, cc735a5) and affect the notation with indices, not repetitions (8e299ca).
This is related also to #260 and 2b94ea7, which extended parseArrays from indexed-only to also apply to [] notation, without index.
I think this is a documentation "bug" that requires clarification or maybe a combination of documentation and code problems (especially with changes to 6.14.1), but this requires answering some questions:
- Should
parseArrays: falsebe equivalent toarrayLimit: -1?- If not, then how does it affect
duplicates: 'combine'? (it doesn't, but should this be considered a bug?) - In any case, the documentation is very vague and needs clarification.
- If not, then how does it affect
- Should
arrayLimitapply to arrays without explicit index (Query string array parsing behavior changed in version 6.14.1 #537)?- Until GHSA-6rw7-vpxm-498p and 6.14.1 the answer was no (Query string array parsing behavior changed in version 6.14.1 #537 (comment)).
- Should
a[]=b&a[]=cbehave differently froma=b&a=cand create a sub-object with key'0'that contains an array/object?- This, I think, is a bug (likely introduced when fixing Bug Report:
qs.parsewhen parsing a string with empty indexes[]in a key. #260, but I did not test older versions).
- This, I think, is a bug (likely introduced when fixing Bug Report: