Skip to content

fix: HTTP query string params array parsing #38222

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kodiakhq merged 5 commits into from
Jan 16, 2026
Merged

fix: HTTP query string params array parsing #38222

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
da2f455
fix: HTTP query params array parsing
sampaiodiego Jan 16, 2026
af7081e
test: add tests
sampaiodiego Jan 16, 2026
eaa9ff5
return status 400 if query string is not valid
sampaiodiego Jan 16, 2026
76a6045
test: parse as array even tithout brackets
sampaiodiego Jan 16, 2026
0f668c9
revert changes
sampaiodiego Jan 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 10 additions & 3 deletions packages/http-router/src/Router.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,10 +5,10 @@ import express from 'express';
import type { Context, HonoRequest, MiddlewareHandler } from 'hono';
import { Hono } from 'hono';
import type { StatusCode } from 'hono/utils/http-status';
import qs from 'qs'; // Using qs specifically to keep express compatibility

import type { ResponseSchema, TypedOptions } from './definition';
import { honoAdapterForExpress } from './middlewares/honoAdapterForExpress';
import { parseQueryParams } from './parseQueryParams';

const logger = new Logger('HttpRouter');

Expand Down Expand Up @@ -186,7 +186,7 @@ export class Router<
}

protected parseQueryParams(request: HonoRequest) {
return qs.parse(request.raw.url.split('?')?.[1] || '');
return parseQueryParams(request.raw.url.split('?')?.[1] || '');
}

protected method<TSubPathPattern extends string, TOptions extends TypedOptions>(
Expand All @@ -201,7 +201,14 @@ export class Router<
this.innerRouter[method.toLowerCase() as Lowercase<Method>](`/${subpath}`.replace('//', '/'), ...middlewares, async (c) => {
const { req, res } = c;

const queryParams = this.parseQueryParams(req);
let queryParams: Record<string, any>;
try {
queryParams = this.parseQueryParams(req);
} catch (e) {
logger.warn({ msg: 'Error parsing query params for request', path: req.path, err: e });

return c.json({ success: false, error: 'Invalid query parameters' }, 400);
}

if (options.query) {
const validatorFn = options.query;
Expand Down
60 changes: 60 additions & 0 deletions packages/http-router/src/parseQueryParams.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,60 @@
import { parseQueryParams } from './parseQueryParams';

describe('parseQueryParams', () => {
it('should parse simple query string', () => {
const result = parseQueryParams('foo=bar');
expect(result).toEqual({ foo: 'bar' });
});

it('should parse multiple query parameters', () => {
const result = parseQueryParams('foo=bar&baz=qux');
expect(result).toEqual({ foo: 'bar', baz: 'qux' });
});

it('should parse array parameters', () => {
const result = parseQueryParams('ids[]=1&ids[]=2&ids[]=3');
expect(result).toEqual({ ids: ['1', '2', '3'] });
});

it('should parse nested objects', () => {
const result = parseQueryParams('user[name]=john&user[age]=30');
expect(result).toEqual({ user: { name: 'john', age: '30' } });
});

it('should handle empty query string', () => {
const result = parseQueryParams('');
expect(result).toEqual({});
});

it('should decode URL encoded values', () => {
const result = parseQueryParams('name=John%20Doe');
expect(result).toEqual({ name: 'John Doe' });
});

it('should handle boolean-like values as strings', () => {
const result = parseQueryParams('active=true&disabled=false');
expect(result).toEqual({ active: 'true', disabled: 'false' });
});

it('should throw error when array limit is exceeded', () => {
const largeArray = Array(501)
.fill(0)
.map((_, i) => `ids[]=${i}`)
.join('&');
expect(() => parseQueryParams(largeArray)).toThrow();
});

it('should parse arrays within the limit', () => {
const array = Array(500)
.fill(0)
.map((_, i) => `ids[]=${i}`)
.join('&');
const result = parseQueryParams(array);
expect(result.ids).toHaveLength(500);
});

it('should parse as array even without brackets', () => {
const result = parseQueryParams('ids=1&ids=2');
expect(result.ids).toHaveLength(2);
});
});
5 changes: 5 additions & 0 deletions packages/http-router/src/parseQueryParams.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
import qs from 'qs'; // Using qs specifically to keep express compatibility

export function parseQueryParams(url: string) {
return qs.parse(url, { arrayLimit: 500, throwOnLimitExceeded: true });
}
Loading