querystring: don't stringify bad surrogate pair

Fixes: #3702
PR-URL: #5858
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Author: mscdex

lib/querystring.js

@@ -138,7 +138,12 @@ QueryString.escape = function(str) {
 }
 // Surrogate pair
 ++i;
-c=0x10000+(((c&0x3FF)<<10)|(str.charCodeAt(i)&0x3FF));
+varc2;
+if(i<str.length)
+c2=str.charCodeAt(i)&0x3FF;
+else
+thrownewURIError('URI malformed');
+c=0x10000+(((c&0x3FF)<<10)|c2);
 out+=hexTable[0xF0|(c>>18)]+
 hexTable[0x80|((c>>12)&0x3F)]+
 hexTable[0x80|((c>>6)&0x3F)]+

test/parallel/test-querystring.js

@@ -139,6 +139,11 @@ qsWeirdObjects.forEach(function(testCase) {
 assert.equal(testCase[1],qs.stringify(testCase[0]));
 });
 
+// invalid surrogate pair throws URIError
+assert.throws(function(){
+qs.stringify({foo: '\udc00'});
+},URIError);
+
 // coerce numbers to string
 assert.strictEqual('foo=0',qs.stringify({foo: 0}));
 assert.strictEqual('foo=0',qs.stringify({foo: -0}));