expressjs / expressjs/express

Query Param Silently Remove param query value if it is over 1000

Open
#5,878 12 comments 1 reaction 0 assignees View on GitHub
bug
Dominant language
JavaScript
Stars
69.5k
Forks
25k
Avg merge
4d 20h
Merged PRs (30d)
9

Description

## Issue

The issue here is that if I have a really long query param(over 1000) ie. test?ids[]=1&ids[]=2..., it will truncate the value after length over 1000. This is because the `qs` library has a default `parameterLimit` of 1000 which then it won't parse any more value after. It seems in `express body parser`, this issue also exists but it returns an error if it is over a limit. https://github.com/expressjs/body-parser#parameterlimit
image

I know you can override the default `query parser` with my own, however I think this is very dangerous because the api shouldn't silently return incorrect value without warning. This issue is also coming from 2 layer of library deep so it is not easy to figure out for user of expressjs in my opinion.

## Fix
1. it should either return an error(similar to body parser), because I think this shouldn't silently remove value without alerting the engineer

2. Alternatively we should set the `parameterLimit` limit to infinite(in qs options), this way if the user want to change the limit, they can knowingly change it, the users who are not aware of this won't be affected.

I can help with the PR if the above makes sense.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.