diff --git a/lib/utils.js b/lib/utils.js index 2c37309b..747f9460 100644 --- a/lib/utils.js +++ b/lib/utils.js @@ -110,7 +110,8 @@ var assign = function assignSingleSource(target, source) { var decode = function (str, decoder, charset) { var strWithoutPlus = str.replace(/\+/g, ' '); if (charset === 'iso-8859-1') { - return unescape(strWithoutPlus); // Cannot throw + // unescape never throws, no try...catch needed: + return strWithoutPlus.replace(/%[0-9a-f]{2}/gi, unescape); } // utf-8 try { diff --git a/test/parse.js b/test/parse.js index 83263d8f..eff07e09 100644 --- a/test/parse.js +++ b/test/parse.js @@ -627,5 +627,10 @@ test('parse()', function (t) { st.end(); }); + t.test('does not interpret %uXXXX syntax in iso-8859-1 mode', function (st) { + st.deepEqual(qs.parse('%u263A=%u263A', { charset: 'iso-8859-1' }), { '%u263A': '%u263A' }); + st.end(); + }); + t.end(); });