This repository was archived by the owner on Apr 30, 2021. It is now read-only.
File tree Expand file tree Collapse file tree 4 files changed +50
-1
lines changed Expand file tree Collapse file tree 4 files changed +50
-1
lines changed Original file line number Diff line number Diff line change @@ -129,6 +129,7 @@ any unnecessary work is done.
129129## Trophies
130130* [jpeg- js: OOM / DoS](https: // github.com/eugeneware/jpeg-js/issues/53)
131131* [@webassemblyjs/ wast- parser: Crash/ TypeError ](https: // github.com/xtuc/webassemblyjs/issues/669)
132- * [decompress: Crash/ TypeError ](https: // github.com/kevva/decompress/issues/72)
132+ * [decompress: Crash/ TypeError ](https: // github.com/kevva/decompress/issues/72)
133+ * [qs: logic bug/ inequality](https: // github.com/ljharb/qs/issues/340)
133134
134135** Feel free to add bugs that you found with jsfuzz to this list via pull- request**
Original file line number Diff line number Diff line change 1+ const qs = require ( 'qs' ) ;
2+ const assert = require ( 'assert' ) ;
3+
4+ function isASCII ( str ) {
5+ return / ^ [ - ~ ] + $ / . test ( str ) ;
6+ }
7+
8+ function fuzz ( buf ) {
9+ const str = buf . toString ( ) ;
10+ if ( ! isASCII ( str ) ) {
11+ return
12+ }
13+ const obj = qs . parse ( str ) ;
14+ const str1 = qs . stringify ( obj ) ;
15+ const obj1 = qs . parse ( str1 ) ;
16+ assert . deepEqual ( obj , obj1 ) ;
17+ }
18+
19+ module . exports = {
20+ fuzz
21+ } ;
Original file line number Diff line number Diff line change 1+ {
2+ "name" : " qs-fuzz" ,
3+ "version" : " 1.0.0" ,
4+ "description" : " " ,
5+ "main" : " fuzz.js" ,
6+ "scripts" : {
7+ "test" : " echo \" Error: no test specified\" && exit 1"
8+ },
9+ "author" : " " ,
10+ "license" : " ISC" ,
11+ "dependencies" : {
12+ "qs" : " ^6.9.0"
13+ }
14+ }
You can’t perform that action at this time.
0 commit comments