fix: Encode URI components in serializer

neet · Nov 25, 2022 · 8a2be08 · 8a2be08
1 parent ebdaee8
commit 8a2be08
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 4 deletions.
diff --git a/src/serializers/rails-querystring.spec.ts b/src/serializers/rails-querystring.spec.ts
@@ -25,6 +25,14 @@ describe('railsQueryString', () => {
     expect(result).toBe('key1=value1&key2=value2');
   });
 
+  it('encodes string safely', () => {
+    const result = railsQueryString.stringify({
+      q: 'https://neet.love',
+    });
+    // cspell:disable-next-line
+    expect(result).toBe('q=https%3A%2F%2Fneet.love');
+  });
+
   it('encodes an array inside a record', () => {
     const result = railsQueryString.stringify({
       key1: 'value1',

diff --git a/src/serializers/rails-querystring.ts b/src/serializers/rails-querystring.ts
@@ -14,13 +14,17 @@ const stringify = (object?: unknown): string => {
   const values = Object.entries(object)
     .reduce<string[]>((prev, [k, v]) => {
       if (Array.isArray(v)) {
-        const xs = v.map((x) => `${k}[]=${x}`);
+        const xs = v.map((x) => `${k}[]=${encodeURIComponent(x)}`);
         return [...prev, ...xs];
       }
-      if (isObject(v)) {
-        throw new TypeError('Encoding nested object is not supported');
+      if (
+        typeof v === 'string' ||
+        typeof v === 'number' ||
+        typeof v === 'boolean'
+      ) {
+        return [...prev, `${k}=${encodeURIComponent(v)}`];
       }
-      return [...prev, `${k}=${v}`];
+      throw new TypeError('Encoding nested object is not supported');
     }, [])
     .join('&');