kelp404 / capybara-router / 42332405117

92%

push

github

fix: replace query-string with a native implementation

query-string 9.5.1 depends on decode-uri-component 0.5.0, which is
vulnerable to DoS via quadratic replacement of percent-encoded runs
(GHSA-qr28-fpjm-wq7f). query-string 10 fixes it but uses the regex `v`
flag, which breaks older browsers (Safari < 17, Chrome < 112).

Add lib/query-string.js with parse() and stringify() that match
query-string's default behavior, so the router has no vulnerable
dependency and keeps the same browser support.

- Decode on UTF-8 bytes in linear time; invalid sequences become U+FFFD
  like URLSearchParams.
- Collect repeated keys in linear time.
- Encode lone surrogates as U+FFFD instead of throwing URIError.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

166 of 197 branches covered (84.26%)

Branch coverage included in aggregate %.

39 of 39 new or added lines in 3 files covered. (100.0%)

388 of 408 relevant lines covered (95.1%)

2833.97 hits per line