expressjs / expressjs/body-parser

Should URLSearchParams be used in node.js 8 instead of querystring?

Open
#252 23 comments 0 reactions 0 assignees View on GitHub
discuss
Dominant language
JavaScript
Stars
5.5k
Forks
767
Avg merge
13h 53m
Merged PRs (30d)
10

Description

Node >= 8.0 introduced an issue in querystring.parse (see here https://github.com/nodejs/node/issues/13773) that will affect all users of body-parser. It occurs when there is a trailing whitespace in a query string parameter:

Before `require('querystring').parse('a=%20+&')` was `{ a: ' ' }`

In node 8.x `require('querystring').parse('a=%20+&')` is `{ a: '%20 ' }`

This applies to any parameter value ending with a space.

Even though it is not body-parser's fault, this issue can cause non trivial problems that are very hard to track down. By updating any app that uses body-parser on older node versions to node 8.x, any url-encoded form input with a trailing space will start to have the encoding of special characters broken. It took us a long time to discover the issue and to find out where the problem was. In the issue mentioned above, it is suggested that the new *[URLSearchParams](https://nodejs.org/api/url.html#url_class_urlsearchparams)* class is a faster way of parsing query strings and more similar to native browser implementations. Does it make sense to consider it?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.