fix: Encode invisible ASCII control characters (#783)

47ng · Nov 23, 2024 · c768757 · c768757
1 parent 56e15a0
commit c768757
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 0 deletions.
diff --git a/packages/nuqs/src/url-encoding.test.ts b/packages/nuqs/src/url-encoding.test.ts
@@ -24,6 +24,12 @@ describe('url-encoding/encodeQueryValue', () => {
     expect(encodeQueryValue('<')).toEqual(encodeURIComponent('<'))
     expect(encodeQueryValue('>')).toEqual(encodeURIComponent('>'))
   })
+  test('hidden ASCII characters are encoded', () => {
+    const chars = Array.from({ length: 32 }, (_, i) => String.fromCharCode(i))
+    chars.forEach(char => {
+      expect(encodeQueryValue(char)).toBe(encodeURIComponent(char))
+    })
+  })
   test('Alphanumericals are passed through', () => {
     const input = 'abcdefghijklmnopqrstuvwxyz0123456789'
     expect(encodeQueryValue(input)).toBe(input)

diff --git a/packages/nuqs/src/url-encoding.ts b/packages/nuqs/src/url-encoding.ts
@@ -42,6 +42,8 @@ export function encodeQueryValue(input: string) {
       .replace(/`/g, '%60')
       .replace(/</g, '%3C')
       .replace(/>/g, '%3E')
+      // Encode invisible ASCII control characters
+      .replace(/[\x00-\x1F]/g, char => encodeURIComponent(char))
   )
 }