[Fix] stringify: ensure a non-string filter does not crash

ljharb · Aug 7, 2024 · 99fd543 · 99fd543
1 parent d089efd
commit 99fd543
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 2 deletions.
diff --git a/lib/stringify.js b/lib/stringify.js
@@ -150,7 +150,7 @@ var stringify = function stringify(
         objKeys = sort ? keys.sort(sort) : keys;
     }
 
-    var encodedPrefix = encodeDotInKeys ? prefix.replace(/\./g, '%2E') : prefix;
+    var encodedPrefix = encodeDotInKeys ? String(prefix).replace(/\./g, '%2E') : String(prefix);
 
     var adjustedPrefix = commaRoundTrip && isArray(obj) && obj.length === 1 ? encodedPrefix + '[]' : encodedPrefix;
 
@@ -166,7 +166,7 @@ var stringify = function stringify(
             continue;
         }
 
-        var encodedKey = allowDots && encodeDotInKeys ? key.replace(/\./g, '%2E') : key;
+        var encodedKey = allowDots && encodeDotInKeys ? String(key).replace(/\./g, '%2E') : String(key);
         var keyPrefix = isArray(obj)
             ? typeof generateArrayPrefix === 'function' ? generateArrayPrefix(adjustedPrefix, encodedKey) : adjustedPrefix
             : adjustedPrefix + (allowDots ? '.' + encodedKey : '[' + encodedKey + ']');

diff --git a/test/stringify.js b/test/stringify.js
@@ -1295,4 +1295,16 @@ test('stringifies empty keys', function (t) {
 
         st.end();
     });
+
+    t.test('stringifies non-string keys', function (st) {
+        var actual = qs.stringify({ a: 'b', 'false': {} }, {
+            filter: ['a', false],
+            allowDots: true,
+            encodeDotInKeys: true
+        });
+
+        st.equal(actual, 'a=b', 'stringifies correctly');
+
+        st.end();
+    });
 });