Skip to content

fix: restore array parsing for req.query repeated keys (#7147) #7181

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
SAY-5 wants to merge 2 commits into
base: 4.x
Choose a base branch
from
Open

fix: restore array parsing for req.query repeated keys (#7147) #7181

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c0b4eaa
fix: restore array parsing for `req.query` repeated keys (#7147)
SAY-5 Apr 15, 2026
f0a137e
chore: drop comment and issue refrences, drop sparse array test
jonchurch Apr 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion lib/utils.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -287,7 +287,8 @@ function createETagGenerator (options) {

function parseExtendedQueryString(str) {
return qs.parse(str, {
allowPrototypes: true
allowPrototypes: true,
arrayLimit: 1000
Copy link
Copy Markdown
Member

@jonchurch jonchurch Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
arrayLimit: 1000
arrayLimit: 1000,
allowSparse: true

Per @ljharb's comment, this would allow folks to still access arr[500]=foo as an object ala a["500"] === "foo".

this is in reference to this bit of my comment:

Note on indexed-bracket notation: qs uses arrayLimit as a single knob across three parsing paths (repeated keys, empty-bracket arr[]=, and indexed-bracket arr[N]=). For indexed-bracket queries at indices 21..999, this PR widens the threshold past 4.21's effective limit of 20 — ?arr[500]=v will now parse as an array ["v"] rather than an object {"500":"v"}.

This is, to me, a surprising side effect. But I do think it is reasonable as my own experience expects that the repeated key form is more common. Open to input here though

});
}

Expand Down
14 changes: 14 additions & 0 deletions test/req.query.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,20 @@ describe('req', function(){
.get('/?user.name=tj')
.expect(200, '{"user.name":"tj"}', done);
});

it('should parse more than 20 repeated values as an array', function (done) {
var app = createApp('extended');
var ids = [];
var expected = [];
for (var i = 0; i < 25; i++) {
ids.push('ids=' + i);
expected.push(String(i));
}

request(app)
.get('/?' + ids.join('&'))
.expect(200, JSON.stringify({ ids: expected }), done);
});
});

describe('when "query parser" is simple', function () {
Expand Down
Loading