v6.2.2

CHANGELOG.md

@@ -1,3 +1,6 @@
+## **6.2.2**
+- [Fix] ensure that `allowPrototypes: false` does not ever shadow Object.prototype properties
+
 ## **6.2.1**
 - [Fix] ensure `key[]=x&key[]&key[]=y` results in 3, not 2, values
 - [Refactor] Be explicit and use `Object.prototype.hasOwnProperty.call`

component.json

@@ -2,7 +2,7 @@
   "name": "qs",
   "repository": "hapijs/qs",
   "description": "query-string parser / stringifier with nesting support",
-  "version": "6.1.0",
+  "version": "6.2.2",
   "keywords": ["querystring", "query", "parser"],
   "main": "lib/index.js",
   "scripts": [

dist/qs.js

@@ -67,7 +67,7 @@ var parseObject = function parseObject(chain, val, options) {
         obj = obj.concat(parseObject(chain, val, options));
     } else {
         obj = options.plainObjects ? Object.create(null) : {};
-        var cleanRoot = root[0] === '[' && root[root.length - 1] === ']' ? root.slice(1, root.length - 1) : root;
+        var cleanRoot = root.charAt(0) === '[' && root.charAt(root.length - 1) === ']' ? root.slice(1, -1) : root;
         var index = parseInt(cleanRoot, 10);
         if (
             !isNaN(index) &&
@@ -96,8 +96,8 @@ var parseKeys = function parseKeys(givenKey, val, options) {
 
     // The regex chunks
 
-    var parent = /^([^\[\]]*)/;
-    var child = /(\[[^\[\]]*\])/g;
+    var parent = /^([^[]*)/;
+    var child = /(\[[^[\]]*])/g;
 
     // Get the parent
 
@@ -123,9 +123,9 @@ var parseKeys = function parseKeys(givenKey, val, options) {
     var i = 0;
     while ((segment = child.exec(key)) !== null && i < options.depth) {
         i += 1;
-        if (!options.plainObjects && has.call(Object.prototype, segment[1].replace(/\[|\]/g, ''))) {
+        if (!options.plainObjects && has.call(Object.prototype, segment[1].slice(1, -1))) {
             if (!options.allowPrototypes) {
-                continue;
+                return;
             }
         }
         keys.push(segment[1]);

package.json

@@ -2,7 +2,7 @@
   "name": "qs",
   "description": "A querystring parser that supports nesting and arrays, with a depth limit",
   "homepage": "https://github.com/ljharb/qs",
-  "version": "6.2.1",
+  "version": "6.2.2",
   "repository": {
     "type": "git",
     "url": "https://github.com/ljharb/qs.git"