Skip to content

Commit 65fc4e3

Browse files
mscdexMyles Borins
authored and
Myles Borins
committed
querystring: don't stringify bad surrogate pair
Fixes: #3702 PR-URL: #5858 Reviewed-By: Ben Noordhuis <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: James M Snell <[email protected]>
1 parent aed22d0 commit 65fc4e3

File tree

2 files changed

+11
-1
lines changed

2 files changed

+11
-1
lines changed

lib/querystring.js

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,12 @@ QueryString.escape = function(str) {
138138
}
139139
// Surrogate pair
140140
++i;
141-
c = 0x10000 + (((c & 0x3FF) << 10) | (str.charCodeAt(i) & 0x3FF));
141+
var c2;
142+
if (i < str.length)
143+
c2 = str.charCodeAt(i) & 0x3FF;
144+
else
145+
throw new URIError('URI malformed');
146+
c = 0x10000 + (((c & 0x3FF) << 10) | c2);
142147
out += hexTable[0xF0 | (c >> 18)] +
143148
hexTable[0x80 | ((c >> 12) & 0x3F)] +
144149
hexTable[0x80 | ((c >> 6) & 0x3F)] +

test/parallel/test-querystring.js

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,11 @@ qsWeirdObjects.forEach(function(testCase) {
139139
assert.equal(testCase[1], qs.stringify(testCase[0]));
140140
});
141141

142+
// invalid surrogate pair throws URIError
143+
assert.throws(function() {
144+
qs.stringify({ foo: '\udc00' });
145+
}, URIError);
146+
142147
// coerce numbers to string
143148
assert.strictEqual('foo=0', qs.stringify({ foo: 0 }));
144149
assert.strictEqual('foo=0', qs.stringify({ foo: -0 }));

0 commit comments

Comments
 (0)