Skip to content

Escape quoted parameter names the way parse understands#447

Closed
naveentehrpariya wants to merge 1 commit into
pillarjs:masterfrom
naveentehrpariya:fix-stringify-name-escaping
Closed

Escape quoted parameter names the way parse understands#447
naveentehrpariya wants to merge 1 commit into
pillarjs:masterfrom
naveentehrpariya:fix-stringify-name-escaping

Conversation

@naveentehrpariya

Copy link
Copy Markdown

stringifyName uses JSON.stringify to quote non-identifier parameter names, but parse only recognizes a backslash as escaping the next literal character. The two schemes agree for \" and \\ — and diverge for every character JSON escapes into a sequence (\t, \n, \uXXXX, …), silently corrupting the round-trip:

const a = parse(':"a\tb"'); // name === 'a\tb' (tab is legal inside quotes)
const s = stringify(a);      // ':"a\tb"'  (JSON-escaped)
const b = parse(s);          // name === 'atb'  ← backslash stripped, 't' kept

This changes which parameter a compiled/matched route produces, with no error anywhere.

The fix quotes names by escaping only " and \ and emitting all other characters directly, which parse reads back unchanged.

Also adds stringify cases for a control character and quote/backslash in names, plus a round-trip assertion that parse(stringify(data)) reproduces the original tokens for every stringify case — that assertion fails on master for the new cases and passes here.

stringifyName used JSON.stringify to quote non-identifier parameter
names, but parse only recognizes a backslash as escaping the next
literal character. The schemes agree for \" and \\, and diverge for
every character JSON escapes into a sequence: a name containing a tab
stringified to ':"a\tb"', which parse read back as the name 'atb',
silently corrupting the token round-trip.

Quote names by escaping only '"' and '\', emitting all other
characters directly, which parse reads back unchanged. Adds stringify
cases for a control character and quote/backslash in names, and a
round-trip assertion that parse(stringify(data)) reproduces the
original tokens for every stringify case.
@krzysdz

krzysdz commented Jul 8, 2026

Copy link
Copy Markdown

Isn't this a duplicate of #445?

@blakeembrey

Copy link
Copy Markdown
Member

Thanks @krzysdz. I'm going to close this in favor of the first PR.

@blakeembrey blakeembrey closed this Jul 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants