Long Arrays converted to Objects

I’ve notice that when I add a long array to a query string the body parser converts it to an Object. For instance:

curl -L -G -d "arr[0]=1&arr[1]=2&arr[2]=3&arr[3]=4&arr[4]=5&arr[5]=6&arr[6]=7&arr[7]=8&arr[8]=9&arr[9]=10&arr[10]=11&arr[11]=12&arr[12]=13&arr[13]=14&arr[14]=15&arr[15]=16&arr[16]=17&arr[17]=18&arr[18]=19&arr[19]=20&arr[20]=21&arr[21]=22" http://localhost:8888/test

This will result in:

{arr: {
    '0': '1',
    '1': '2',
    '2': '3',
    '3': '4',
    '4': '5',
    '5': '6',
    '6': '7',
    '7': '8',
    '8': '9',
    '9': '10',
    '10': '11',
    '11': '12',
    '12': '13',
    '13': '14',
    '14': '15',
    '15': '16',
    '16': '17',
    '17': '18',
    '18': '19',
    '19': '20',
    '20': '21',
    '21': '22'
  }
}

It seems to work just fine if you keep the length of your array at 20 or bellow.

curl -L -G -d "arr[0]=1&arr[1]=2&arr[2]=3&arr[3]=4&arr[4]=5&arr[5]=6&arr[6]=7&arr[7]=8&arr[8]=9&arr[9]=10&arr[10]=11&arr[11]=12&arr[12]=13&arr[13]=14&arr[14]=15&arr[15]=16&arr[16]=17&arr[17]=18&arr[18]=19&arr[19]=20&arr[20]=21]" http://localhost:8888/test

{
	arr: [ '1', '2', '3', '4', '5', '6', '7', '8', '9', '10', '11', '12', '13', '14', '15', '16', '17', '18', '19', '20', '21', '22'] 
}

Any ideas why this is happening?

body-parser: v1.18.2 express: v4.12.0 node: v6.9.2

[jwerre]

Just in case anyone else comes across this the issue is discussed here:

https://github.com/expressjs/express/issues/3039

basically…

var qs = require('qs');
var app = require('express')();

app.set('query parser', function (str) {
  return qs.parse(str, { arrayLimit: Infinity });
});

[dougwilson]

But I’ve seen that before, and the qs module will limit properties to 20, which is lame, though they did it for security reasons. Instead I have this module limit the number of properties to the number of body parameters, so normal behavior will get the arrays they expect up to any length while still mitigating the underlying security issue of arr[0]=foo&arr[999999999999999999]=bar allocating a large array and crashing the process 👍