"use strict" module.exports = function(string) { if (string === "" || string == null) return {} if (string.charAt(0) === "?") string = string.slice(1) var entries = string.split("&"), counters = {}, data = {} for (var i = 0; i < entries.length; i++) { var entry = entries[i].split("=") var key = decodeURIComponent(entry[0]) var value = entry.length === 2 ? decodeURIComponent(entry[1]) : "" if (value === "true") value = true else if (value === "false") value = false var levels = key.split(/\]\[?|\[/) var cursor = data if (key.indexOf("[") > -1) levels.pop() for (var j = 0; j < levels.length; j++) { var level = levels[j], nextLevel = levels[j + 1] var isNumber = nextLevel == "" || !isNaN(parseInt(nextLevel, 10)) var isValue = j === levels.length - 1 if (level === "") { var key = levels.slice(0, j).join() if (counters[key] == null) { counters[key] = Array.isArray(cursor) ? cursor.length : 0 } level = counters[key]++ } // Disallow direct prototype pollution else if (level === "__proto__") break if (isValue) cursor[level] = value else { // Read own properties exclusively to disallow indirect // prototype pollution value = Object.getOwnPropertyDescriptor(cursor, level) if (value != null) value = value.value if (value == null) value = cursor[level] = isNumber ? [] : {} } cursor = value } } return data }