Skip to content

parse: decodeDotInKeys does not decode lowercase percent-encoded dots #634

Open

Description

@guocn

On current main, decodeDotInKeys: true decodes %2E but not the equivalent lowercase %2e, producing different property names. RFC 3986 section 2.1 defines hexadecimal digits in percent encodings as case-insensitive.

var qs = require('qs');
var input = 'name%252eobj.first%252ename=John&name%252Eobj.last%252Ename=Doe';
console.log(qs.parse(input, { decodeDotInKeys: true }));

Expected: { 'name.obj': { 'first.name': 'John', 'last.name': 'Doe' } }

Actual: { 'name%2eobj': { 'first%2ename': 'John' }, 'name.obj': { 'last.name': 'Doe' } }

Reproduced on main 234d505 with Node.js 24.21.0. The later replacement in parseObject only matches uppercase escapes. A regression test fails before the one-character flag fix and passes afterward.

Disclosure: found and prepared with AI assistance (Hermes Agent, gpt-6.1-sol), including independent agent review; no claim of personal production use.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions