Fix empty parameter issue with utf8Sentinel in simple mode

expressjs · Jul 31, 2018 · e3fca5d · e3fca5d
1 parent dab286a
commit e3fca5d
Show file tree

Hide file tree

Showing 2 changed files with 33 additions and 2 deletions.
diff --git a/lib/types/urlencoded.js b/lib/types/urlencoded.js
@@ -80,11 +80,13 @@ function createBodyDecoder (queryparse, charset, utf8Sentinel, interpretNumericE
   return function bodyDecoder (body) {
     var modifiedBody = body
     if (utf8Sentinel) {
-      modifiedBody = modifiedBody.replace(/(?:^|&)utf8=([^&]+)/, function ($0, value) {
+      modifiedBody = modifiedBody.replace(/(^|&)utf8=([^&]+)($|&)/, function ($0, ampBefore, value, ampAfter) {
         if (charsetBySentinel[value]) {
           correctedCharset = charsetBySentinel[value]
         }
-        return ''
+        // Make sure that we only leave an ampersand when replacing in the middle of the query string
+        // as the simple parser will add an empty string parameter if it gets &&
+        return ampBefore && ampAfter ? '&' : ''
       })
     }
     return modifiedBody.length

diff --git a/test/urlencoded.js b/test/urlencoded.js
@@ -77,6 +77,35 @@ describe('bodyParser.urlencoded()', function () {
       .expect(200, '{"user":"ø"}', done)
   })
 
+  describe('in simple mode', function () {
+    it('should not leave an empty string parameter when removing the utf8 sentinel from the start of the string', function (done) {
+      var server = createServer({ utf8Sentinel: true, extended: false })
+      request(server)
+        .post('/')
+        .set('Content-Type', 'application/x-www-form-urlencoded')
+        .send('utf8=%E2%9C%93&foo=bar')
+        .expect(200, '{"foo":"bar"}', done)
+    })
+
+    it('should not leave an empty string parameter when removing the utf8 sentinel from the middle of the string', function (done) {
+      var server = createServer({ utf8Sentinel: true, extended: false })
+      request(server)
+        .post('/')
+        .set('Content-Type', 'application/x-www-form-urlencoded')
+        .send('foo=bar&utf8=%E2%9C%93&baz=quux')
+        .expect(200, '{"foo":"bar","baz":"quux"}', done)
+    })
+
+    it('should not leave an empty string parameter when removing the utf8 sentinel from the end of the string', function (done) {
+      var server = createServer({ utf8Sentinel: true, extended: false })
+      request(server)
+        .post('/')
+        .set('Content-Type', 'application/x-www-form-urlencoded')
+        .send('foo=bar&baz=quux&utf8=%E2%9C%93')
+        .expect(200, '{"foo":"bar","baz":"quux"}', done)
+    })
+  })
+
   it('should handle empty message-body', function (done) {
     request(createServer({ limit: '1kb' }))
       .post('/')