Avoid unescaping %uXXXX in iso-8859-1 mode

ljharb#268 (comment)
papandreou · Jul 25, 2018 · bd9bc06 · bd9bc06
1 parent afb4a16
commit bd9bc06
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/lib/utils.js b/lib/utils.js
@@ -110,7 +110,8 @@ var assign = function assignSingleSource(target, source) {
 var decode = function (str, decoder, charset) {
     var strWithoutPlus = str.replace(/\+/g, ' ');
     if (charset === 'iso-8859-1') {
-        return unescape(strWithoutPlus); // Cannot throw
+        // unescape never throws, no try...catch needed:
+        return strWithoutPlus.replace(/%[0-9a-f]{2}/gi, unescape);
     }
     // utf-8
     try {

diff --git a/test/parse.js b/test/parse.js
@@ -627,5 +627,10 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('does not interpret %uXXXX syntax in iso-8859-1 mode', function (st) {
+        st.deepEqual(qs.parse('%u263A=%u263A', { charset: 'iso-8859-1' }), { '%u263A': '%u263A' });
+        st.end();
+    });
+
     t.end();
 });