Commit 8cf60c5db12 for nodejs
commit 8cf60c5db126a3504b4abeb82143a4f0f1e11d88
Author: Ved Chaudhari <84765263+vedchaudhari@users.noreply.github.com>
Date: Tue Oct 13 13:18:55 2026 +0530
querystring: fix value decoding after encoded keys
In the non-default parse() path, a key with more than one percent
escape could corrupt non-ASCII characters in its value.
Keep key characters out of the value's encoding check.
Assisted-by: claude:opus-5.5
Signed-off-by: vedchaudhari <vedc2853@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66553
Refs: https://github.com/nodejs/node/pull/66175
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
diff --git a/lib/querystring.js b/lib/querystring.js
index 6aca65dee5b..c6dc1afcf5f 100644
--- a/lib/querystring.js
+++ b/lib/querystring.js
@@ -555,8 +555,9 @@ function parse(qs, sep, eq, options) {
key += StringPrototypeSlice(qs, lastPos, i);
key += plusChar;
lastPos = i + 1;
- continue;
}
+ // Don't let key characters affect value encoding.
+ continue;
}
if (code === 43/* + */) {
if (lastPos < i)
diff --git a/test/parallel/test-querystring.js b/test/parallel/test-querystring.js
index b24ec5b569b..ec463e4a45b 100644
--- a/test/parallel/test-querystring.js
+++ b/test/parallel/test-querystring.js
@@ -415,6 +415,18 @@ assert.strictEqual(qs.unescapeBuffer('a%%').toString(), 'a%%');
// Test invalid encoded string
check(qs.parse('%\u0100=%\u0101'), { '%Ā': '%ā' });
+// Test encoded key with unencoded value
+{
+ const input = '%C3%A4=caf\u00e9%';
+
+ check(
+ qs.parse(input),
+ { '\u00e4': 'caf\u00e9%' });
+ check(
+ qs.parse(input, null, null),
+ { '\u00e4': 'caf\u00e9%' });
+}
+
// Test custom decode
{
function demoDecode(str) {