Visitar URL original
fix: restore array parsing for req.query repeated keys (#7181) · expressjs/express@8d09bfe · GitHub
Skip to content

Commit 8d09bfe

Browse files
SAY-5jonchurch
andauthored
fix: restore array parsing for req.query repeated keys (#7181)
fix: restore array parsing for `req.query` repeated keys (#7147) The default `req.query` extended query parser now sets `arrayLimit: 1000` to restore prior array parsing behavior. qs 6.14.1 began enforcing `arrayLimit` for bracket notation (`a[]=1&a[]=2&...`) and repeated-key notation (`a=1&a=2&...`), where it had previously been silently ignored. Express has never set `arrayLimit` explicitly, so once 4.22.0 picked up qs `~6.14.0`, the default `arrayLimit` of 20 began taking effect — `req.query.a` for arrays larger than 20 items was returned as an object with integer keys (`{ '0': ..., '1': ... }`) instead of an array. Prior to qs 6.14.1, the effective ceiling for these notations was qs's default `parameterLimit` of 1000 (also not set by Express). This release passes `arrayLimit: 1000` to keep that practical ceiling, restoring the pre-4.22.0 behavior. Note: this also unifies array-cap behavior across notations. Indexed notation (`a[0]=...`) was historically capped at qs's default `arrayLimit` of 20 even in older qs versions; after this change it also allows up to 1000 items. --------- Co-authored-by: Jon Church <me@jonchurch.com>
1 parent d39e8ad commit 8d09bfe

2 files changed

Lines changed: 16 additions & 1 deletion

File tree

‎lib/utils.js‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -287,7 +287,8 @@ function createETagGenerator (options) {
287287

288288
function parseExtendedQueryString(str) {
289289
return qs.parse(str, {
290-
allowPrototypes: true
290+
allowPrototypes: true,
291+
arrayLimit: 1000
291292
});
292293
}
293294

‎test/req.query.js‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,20 @@ describe('req', function(){
3838
.get('/?user.name=tj')
3939
.expect(200, '{"user.name":"tj"}', done);
4040
});
41+
42+
it('should parse more than 20 repeated values as an array', function (done) {
43+
var app = createApp('extended');
44+
var ids = [];
45+
var expected = [];
46+
for (var i = 0; i < 25; i++) {
47+
ids.push('ids=' + i);
48+
expected.push(String(i));
49+
}
50+
51+
request(app)
52+
.get('/?' + ids.join('&'))
53+
.expect(200, JSON.stringify({ ids: expected }), done);
54+
});
4155
});
4256

4357
describe('when "query parser" is simple', function () {

0 commit comments

Comments
 (0)