secure-qs

A secure and simple query string parser and stringifier for Node.js and TypeScript. Prevents prototype pollution and supports type-safe parsing.

Installation

npm install secure-qs

Usage

const { parse, stringify } = require("secure-qs");

// Parse a query string safely
const obj = parse("foo=bar&baz=qux");
// { foo: 'bar', baz: 'qux' }

// Parse with options for numbers and booleans
const obj2 = parse("num=123&bool=true", {
  parseNumbers: true,
  parseBooleans: true,
});
// { num: 123, bool: true }

// Stringify an object
const str = stringify({ foo: "bar", baz: "qux" });
// 'foo=bar&baz=qux'

API

parse(query: string, options?: { parseNumbers?: boolean, parseBooleans?: boolean })

Returns an object from a query string. Prevents prototype pollution by ignoring dangerous keys.

stringify(obj: Record<string, any>)

Returns a query string from an object.

Security

• Prevents prototype pollution by ignoring keys like __proto__, constructor, and prototype.

License

MIT