fix: prevent crash when query params have conflicting dot-notation keys (#2958)

ordinary9843 · mikicho · web-flow · commit 7ea9933a3571 · 2026-04-05T20:18:15.000Z
fix: return undefined from expand() when a path segment conflicts with a primitive

Co-authored-by: Michael Solomon &lt;github@tltv.co.il&gt;
diff --git a/lib/common.js b/lib/common.js
@@ -682,6 +682,8 @@ const expand = input => {
           } else {
             resultPtr[part] = {}
           }
+        } else if (typeof resultPtr[part] !== 'object') {
+          return undefined
         }
         resultPtr = resultPtr[part]
       }
diff --git a/tests/got/test_query_complex.js b/tests/got/test_query_complex.js
@@ -111,6 +111,15 @@ describe('`query()` complex encoding', () => {
     scope.done()
   })
 
+  it('does not throw on unbalanced dot-notation query params', async () => {
+    const scope = nock('http://example.test')
+      .get('/path')
+      .query({ parent: 'value', 'parent.1': 'first' })
+      .reply(200)
+    await got('http://example.test/path?parent=value&parent.1=first')
+    scope.done()
+  })
+
   it('query with array and regexp', async () => {
     // In Node 10.x this can be updated:
     // const exampleQuery = new URLSearchParams([
diff --git a/tests/test_common.js b/tests/test_common.js
@@ -629,4 +629,8 @@ describe('`expand()`', () => {
     expect(original).deep.equal({ 'foo[bar][0]': 'baz' })
     expect(original).not.equal(result)
   })
+
+  it('returns undefined when a key conflicts with an already-set primitive value', () => {
+    expect(expand({ parent: 'value', 'parent.1': 'first' })).equal(undefined)
+  })
 })

Original file line number	Diff line number	Diff line change
`@@ -682,6 +682,8 @@ const expand = input => {`
`682`	`682`	`} else {`
`683`	`683`	`resultPtr[part] = {}`
`684`	`684`	`}`
	`685`	`+ } else if (typeof resultPtr[part] !== 'object') {`
	`686`	`+ return undefined`
`685`	`687`	`}`
`686`	`688`	`resultPtr = resultPtr[part]`
`687`	`689`	`}`