qs.parse stackoverflow on circular objects

[dougwilson]

So when using qs.parse and passing in an object to expand out the top-level keys, if somewhere in the value is a circular reference, it will fail with RangeError: Maximum call stack size exceeded. Here is a simple example:

var a = {}; a.b = a;
qs.parse({
  'foo[bar]' = 'baz',
  'foo[baz]' = a
})

I'm really only reporting this because it used to work with the old qs library. It was reported to me here: expressjs/connect-multiparty#11 (comment)

[nlf]

Out of curiosity, what's the expected result here?

[nlf]

Also it appears that the old version of qs crashed with this also:

$ npm i [email protected]
[email protected] node_modules/qs
$ node
> var qs = require('qs');
> var a = {}; a.b = a; qs.parse({ 'foo[bar]': 'baz', 'foo[baz]': a })
RangeError: Maximum call stack size exceeded

[dougwilson]

Hm, weird. All I really know is that something with domains used to work with the old qs but not with the new qs according to expressjs/connect-multiparty#11 . I don't use domains, so from the error I was just assuming it was a circular reference.

Anyway, I would assume that it would just copy the reference to the new object with different key names instead of trying to clone the value.

[dougwilson]

So, removing the (useless?) clone call at https://github.com/hapijs/qs/blob/master/lib/parse.js#L141 seem to fix this.

[dougwilson]

Also, I verified that [email protected] does not have the issue. You may have accidentally been using the wrong version of qs when you were trying to test [email protected]. Here is my output from testing the old 0.6.6 version:

$ npm install [email protected]
[email protected] node_modules\qs
$ node -pe 'require("qs/package").version'
0.6.6
$ node -pe 'a={};a.b=a;require("qs").parse({"a[0]": "b", "a[1]": a})'
{ a: [ 'b', { b: [Circular] } ] }

so, as you can see, 0.6.6 did work with circular structures.

[dougwilson]

Actually, it seems like [email protected] has the issue only with certain input, and not with other input, while the current qs just always has a range error. Weird...

[nlf]

I think I have a fix regardless :) Give me just a few minutes

[dougwilson]

haha, no problem. I'm just trying to figure out this weirdness, haha :)