fix: support constructor and __proto__ parameters in Parse URI (#2578) (#2581)

src/core/operations/ParseURI.mjs

@@ -33,7 +33,7 @@ class ParseURI extends Operation {
      * @returns {string}
      */
     run(input, args) {
-        const uri = url.parse(input, true);
+        const uri = url.parse(input, false);
 
         let output = "";
 
@@ -43,7 +43,20 @@ class ParseURI extends Operation {
         if (uri.port) output += "Port:\t\t" + uri.port + "\n";
         if (uri.pathname) output += "Path name:\t" + uri.pathname + "\n";
         if (uri.query) {
-            const keys = Object.keys(uri.query);
+            const queryObj = Object.create(null);
+            for (const [key, value] of new URLSearchParams(uri.query)) {
+                if (Object.prototype.hasOwnProperty.call(queryObj, key)) {
+                    if (Array.isArray(queryObj[key])) {
+                        queryObj[key].push(value);
+                    } else {
+                        queryObj[key] = [queryObj[key], value];
+                    }
+                } else {
+                    queryObj[key] = value;
+                }
+            }
+
+            const keys = Object.keys(queryObj);
             let padding = 0;
 
             keys.forEach(k => {
@@ -51,10 +64,10 @@ class ParseURI extends Operation {
             });
 
             output += "Arguments:\n";
-            for (const key in uri.query) {
+            for (const key in queryObj) {
                 output += "\t" + key.padEnd(padding, " ");
-                if (uri.query[key].length) {
+                if (queryObj[key].length) {
-                    output += " = " + uri.query[key] + "\n";
+                    output += " = " + queryObj[key] + "\n";
                 } else {
                     output += "\n";
                 }

tests/browser/02_ops.js

@@ -278,7 +278,7 @@ module.exports = {
         // testOp(browser, "Parse TLV", "test input", "test_output");
         testOpHtml(browser, "Parse UDP", "04 89 00 35 00 2c 01 01", "tr:last-child td:last-child", "0x0101");
         // testOp(browser, "Parse UNIX file permissions", "test input", "test_output");
-        // testOp(browser, "Parse URI", "test input", "test_output");
+        testOp(browser, "Parse URI", "https://example.com/?constructor=ok&__proto__=hello", /Arguments:\s+constructor = ok\s+__proto__\s+= hello/);
         testOp(browser, "Parse User Agent", "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0 ", /Architecture: amd64/);
         // testOp(browser, "Parse X.509 certificate", "test input", "test_output");
         testOpFile(browser, "Play Media", "files/mp3example.mp3", "audio", "");

tests/node/tests/operations.mjs

@@ -729,6 +729,18 @@ Arguments:
         assert.strictEqual(result.toString(), expected);
     }),
 
+    it("Parse URI with constructor and __proto__ arguments", () => {
+        const result = chef.parseURI("https://example.com/?constructor=ok&__proto__=hello");
+        const expected = `Protocol:	https:
+Hostname:	example.com
+Path name:	/
+Arguments:
+\tconstructor = ok
+\t__proto__   = hello
+`;
+        assert.strictEqual(result.toString(), expected);
+    }),
+
     it("Parse user agent", () => {
         const result = chef.parseUserAgent("Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0 ");
         const expected = `Browser