url: do not use object as hashmap

Fixes cases like new URLSearchParams({ hasOwnProperty: 1 }). PR-URL: #47415 Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]>
nodejs · Jul 6, 2023 · 585e99b · 585e99b
1 parent d0ee898
commit 585e99b
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 8 deletions.
diff --git a/lib/internal/url.js b/lib/internal/url.js
@@ -21,6 +21,7 @@ const {
   ReflectGetOwnPropertyDescriptor,
   ReflectOwnKeys,
   RegExpPrototypeSymbolReplace,
+  SafeMap,
   StringPrototypeCharAt,
   StringPrototypeCharCodeAt,
   StringPrototypeCodePointAt,
@@ -225,7 +226,7 @@ class URLSearchParams {
       } else {
         // Record<USVString, USVString>
         // Need to use reflection APIs for full spec compliance.
-        const visited = {};
+        const visited = new SafeMap();
         const keys = ReflectOwnKeys(init);
         for (let i = 0; i < keys.length; i++) {
           const key = keys[i];
@@ -234,14 +235,15 @@ class URLSearchParams {
             const typedKey = toUSVString(key);
             const typedValue = toUSVString(init[key]);
 
-            // Two different key may result same after `toUSVString()`, we only
-            // leave the later one. Refers to WPT.
-            if (visited[typedKey] !== undefined) {
-              this[searchParams][visited[typedKey]] = typedValue;
+            // Two different keys may become the same USVString after normalization.
+            // In that case, we retain the later one. Refer to WPT.
+            const keyIdx = visited.get(typedKey);
+            if (keyIdx !== undefined) {
+              this[searchParams][keyIdx] = typedValue;
             } else {
-              visited[typedKey] = ArrayPrototypePush(this[searchParams],
-                                                     typedKey,
-                                                     typedValue) - 1;
+              visited.set(typedKey, ArrayPrototypePush(this[searchParams],
+                                                       typedKey,
+                                                       typedValue) - 1);
             }
           }
         }

diff --git a/test/parallel/test-whatwg-url-custom-searchparams-constructor.js b/test/parallel/test-whatwg-url-custom-searchparams-constructor.js
@@ -38,8 +38,13 @@ function makeIterableFunc(array) {
     makeIterableFunc([['key', 'val'], ['key2', 'val2']].map(makeIterableFunc))
   );
   assert.strictEqual(params.toString(), 'key=val&key2=val2');
+  params = new URLSearchParams({ hasOwnProperty: 1 });
+  assert.strictEqual(params.get('hasOwnProperty'), '1');
+  assert.strictEqual(params.toString(), 'hasOwnProperty=1');
   assert.throws(() => new URLSearchParams([[1]]), tupleError);
   assert.throws(() => new URLSearchParams([[1, 2, 3]]), tupleError);
+  assert.throws(() => new URLSearchParams({ [Symbol('test')]: 42 }),
+                TypeError);
   assert.throws(() => new URLSearchParams({ [Symbol.iterator]: 42 }),
                 iterableError);
   assert.throws(() => new URLSearchParams([{}]), tupleError);