Skip to content

🐛 implement DecodeOptions.ListLimit handling to prevent DoS via memory exhaustion #44

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
techouse merged 5 commits into from
Jan 11, 2026
Merged

🐛 implement DecodeOptions.ListLimit handling to prevent DoS via memory exhaustion #44

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
aeebead
fix: implement array limit handling to prevent DoS via memory exhaustion
techouse Jan 11, 2026
a885786
fix: enhance overflow handling in Merge method to respect existing nu…
techouse Jan 11, 2026
8e54046
fix: update qs dependency version to ^6.14.1
techouse Jan 11, 2026
6e03483
fix: add tests for overflow handling in Merge method with integer keys
techouse Jan 11, 2026
26db1f9
fix: refactor Decode test for improved readability and maintainability
techouse Jan 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion QsNet.Comparison/js/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,6 @@
"author": "Klemen Tusar",
"license": "BSD-3-Clause",
"dependencies": {
"qs": "^6.14.0"
"qs": "^6.14.1"
}
}
146 changes: 131 additions & 15 deletions QsNet.Tests/DecodeTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -752,7 +752,7 @@ public void Decode_ParsesMixOfSimpleAndExplicitLists()
.BeEquivalentTo(
new Dictionary<string, object?>
{
["a"] = new List<object?> { "b", "c" }
["a"] = new Dictionary<string, object?> { ["0"] = "b", ["1"] = "c" }
}
);

Expand All @@ -779,7 +779,7 @@ public void Decode_ParsesMixOfSimpleAndExplicitLists()
.BeEquivalentTo(
new Dictionary<string, object?>
{
["a"] = new List<object?> { "b", "c" }
["a"] = new Dictionary<string, object?> { ["0"] = "b", ["1"] = "c" }
}
);

Expand Down Expand Up @@ -1295,7 +1295,13 @@ public void Decode_AllowsEmptyStringsInLists()
.BeEquivalentTo(
new Dictionary<string, object?>
{
["a"] = new List<object?> { "b", null, "c", "" }
["a"] = new Dictionary<string, object?>
{
["0"] = "b",
["1"] = null,
["2"] = "c",
["3"] = ""
}
}
);

Expand All @@ -1319,7 +1325,13 @@ public void Decode_AllowsEmptyStringsInLists()
.BeEquivalentTo(
new Dictionary<string, object?>
{
["a"] = new List<object?> { "b", "", "c", null }
["a"] = new Dictionary<string, object?>
{
["0"] = "b",
["1"] = "",
["2"] = "c",
["3"] = null
}
}
);

Expand Down Expand Up @@ -1434,7 +1446,8 @@ public void Decode_ParsesBuffersCorrectly()
[Fact]
public void Decode_ParsesJqueryParamStrings()
{
const string encoded = "filter%5B0%5D%5B%5D=int1&filter%5B0%5D%5B%5D=%3D&filter%5B0%5D%5B%5D=77&filter%5B%5D=and&filter%5B2%5D%5B%5D=int2&filter%5B2%5D%5B%5D=%3D&filter%5B2%5D%5B%5D=8";
const string encoded =
"filter%5B0%5D%5B%5D=int1&filter%5B0%5D%5B%5D=%3D&filter%5B0%5D%5B%5D=77&filter%5B%5D=and&filter%5B2%5D%5B%5D=int2&filter%5B2%5D%5B%5D=%3D&filter%5B2%5D%5B%5D=8";
var expected = new Dictionary<string, object?>
{
["filter"] = new List<object?>
Expand Down Expand Up @@ -2560,7 +2573,83 @@ public void Decode_ListLimit_HandlesListLimitOfZeroCorrectly()
.BeEquivalentTo(
new Dictionary<string, object?>
{
["a"] = new List<object?> { "1", "2" }
["a"] = new Dictionary<string, object?> { ["0"] = "1", ["1"] = "2" }
}
);
}

[Fact]
public void Decode_ListLimit_RespectsImplicitArrayLimit()
{
var values = Enumerable.Repeat("x", 105).ToArray();
var attack = "a[]=" + string.Join("&a[]=", values);
var result = Qs.Decode(attack, new DecodeOptions { ListLimit = 100 });

result.Should().ContainKey("a");
result["a"].Should().BeAssignableTo<IDictionary>()
.Which.Count.Should().Be(105);
}

[Fact]
public void Decode_ListLimit_BoundaryConditions()
{
Qs.Decode("a[]=1&a[]=2&a[]=3", new DecodeOptions { ListLimit = 3 })
.Should()
.BeEquivalentTo(
new Dictionary<string, object?>
{
["a"] = new List<object?> { "1", "2", "3" }
}
);

Qs.Decode("a[]=1&a[]=2&a[]=3&a[]=4", new DecodeOptions { ListLimit = 3 })
.Should()
.BeEquivalentTo(
new Dictionary<string, object?>
{
["a"] = new Dictionary<string, object?>
{
["0"] = "1",
["1"] = "2",
["2"] = "3",
["3"] = "4"
}
}
);

Qs.Decode("a[]=1&a[]=2", new DecodeOptions { ListLimit = 1 })
.Should()
.BeEquivalentTo(
new Dictionary<string, object?>
{
["a"] = new Dictionary<string, object?> { ["0"] = "1", ["1"] = "2" }
}
);
}

[Fact]
public void Decode_ListLimit_ConvertsDuplicateValuesWhenLimitExceeded()
{
Qs.Decode("a=b&a=c&a=d", new DecodeOptions { ListLimit = 20 })
.Should()
.BeEquivalentTo(
new Dictionary<string, object?>
{
["a"] = new List<object?> { "b", "c", "d" }
}
);

Qs.Decode("a=b&a=c&a=d", new DecodeOptions { ListLimit = 2 })
.Should()
.BeEquivalentTo(
new Dictionary<string, object?>
{
["a"] = new Dictionary<string, object?>
{
["0"] = "b",
["1"] = "c",
["2"] = "d"
}
}
);
}
Expand Down Expand Up @@ -2915,7 +3004,7 @@ public void ShouldParseAMixOfSimpleAndExplicitArrays()
.BeEquivalentTo(
new Dictionary<string, object?>
{
["a"] = new List<object?> { "b", "c" }
["a"] = new Dictionary<string, object?> { ["0"] = "b", ["1"] = "c" }
}
);

Expand All @@ -2933,7 +3022,7 @@ public void ShouldParseAMixOfSimpleAndExplicitArrays()
.BeEquivalentTo(
new Dictionary<string, object?>
{
["a"] = new List<object?> { "b", "c" }
["a"] = new Dictionary<string, object?> { ["0"] = "b", ["1"] = "c" }
}
);
}
Expand Down Expand Up @@ -3423,7 +3512,13 @@ public void ShouldAllowForEmptyStringsInArrays()
.BeEquivalentTo(
new Dictionary<string, object?>
{
["a"] = new List<object?> { "b", null, "c", "" }
["a"] = new Dictionary<string, object?>
{
["0"] = "b",
["1"] = null,
["2"] = "c",
["3"] = ""
}
}
);

Expand All @@ -3441,7 +3536,13 @@ public void ShouldAllowForEmptyStringsInArrays()
.BeEquivalentTo(
new Dictionary<string, object?>
{
["a"] = new List<object?> { "b", "", "c", null }
["a"] = new Dictionary<string, object?>
{
["0"] = "b",
["1"] = "",
["2"] = "c",
["3"] = null
}
}
);

Expand All @@ -3450,7 +3551,12 @@ public void ShouldAllowForEmptyStringsInArrays()
.BeEquivalentTo(
new Dictionary<string, object?>
{
["a"] = new List<object?> { "", "b", "c" }
["a"] = new Dictionary<string, object?>
{
["0"] = "",
["1"] = "b",
["2"] = "c"
}
}
);
}
Expand Down Expand Up @@ -4178,9 +4284,19 @@ public void Decode_CommaSplit_NoTruncationWhenSumExceedsLimit_AndThrowOff()
var result = Qs.Decode("a=1,2&a=3,4,5", opts);

var dict = Assert.IsType<Dictionary<string, object?>>(result);
var list = Assert.IsType<List<object?>>(dict["a"]);
// With ThrowOnLimitExceeded = false, no truncation occurs; full concatenation is allowed
list.Select(x => x?.ToString()).Should().Equal("1", "2", "3", "4", "5");
var list = Assert.IsType<Dictionary<string, object?>>(dict["a"]);
// With ThrowOnLimitExceeded = false, values are preserved but list limit still converts to a map.
list.Should()
.BeEquivalentTo(
new Dictionary<string, object?>
{
["0"] = "1",
["1"] = "2",
["2"] = "3",
["3"] = "4",
["4"] = "5"
}
);
}

[Fact]
Expand Down Expand Up @@ -4821,4 +4937,4 @@ public void Decode_CommaSplit_ThrowsWhenSumExceedsLimitAndThrowOn()
private static partial Regex MyRegex();

#endregion
}
}
Loading
Loading