From a57b5f179b8859776550f3b754f972fad8955566 Mon Sep 17 00:00:00 2001 From: Eduardo San Martin Morote Date: Thu, 27 May 2021 15:14:24 +0200 Subject: [PATCH] fix(query): allow arbitrary keys in queries Revert "fix: do not allow invalid hazardous keys in query (#880)" This reverts commit ecd52e017ac30fa996d4796974371374f65640d1. --- __tests__/parseQuery.spec.ts | 11 ----------- src/query.ts | 6 ------ 2 files changed, 17 deletions(-) diff --git a/__tests__/parseQuery.spec.ts b/__tests__/parseQuery.spec.ts index 7c849bbdf..b16c86245 100644 --- a/__tests__/parseQuery.spec.ts +++ b/__tests__/parseQuery.spec.ts @@ -85,15 +85,4 @@ describe('parseQuery', () => { expect('decoding "%"').toHaveBeenWarnedTimes(1) }) - - it('ignores __proto__', () => { - const query = parseQuery('__proto__=1') - expect(query.__proto__).toEqual(Object.prototype) - expect(query.constructor).toEqual(Object) - }) - - it('ignores build-in methods', () => { - const query = parseQuery('toString=1') - expect(query.toString).toEqual(Object.prototype.toString) - }) }) diff --git a/src/query.ts b/src/query.ts index db951c75e..357e40da1 100644 --- a/src/query.ts +++ b/src/query.ts @@ -57,12 +57,6 @@ export function parseQuery(search: string): LocationQuery { // allow the = character let eqPos = searchParam.indexOf('=') let key = decode(eqPos < 0 ? searchParam : searchParam.slice(0, eqPos)) - - // this ignores ?__proto__&toString - if (Object.prototype.hasOwnProperty(key)) { - continue - } - let value = eqPos < 0 ? null : decode(searchParam.slice(eqPos + 1)) if (key in query) {