querystring: fix unescape override

Documentation states that `querystring.unescape` may be overridden to
replace unescaper during parsing. However, the function was only
being used as a fallback for when the native decoder throws (on a
malformed URL). This patch moves the call to the native function and
the try/catch around it into querystring.unescape then has the parser
always invoke it, so that an override will always be used.

Fixes #4055

Reviewed-By: Fedor Indutny <fedor@indutny.com>

1 files changed, 7 insertions, 8 deletions

diff --git a/lib/querystring.js b/lib/querystring.js
index 0ab739a522..f8c79216d3 100644
--- a/lib/querystring.js
+++ b/lib/querystring.js
@@ -105,7 +105,11 @@ QueryString.unescapeBuffer = function(s, decodeSpaces) {
 
 
 QueryString.unescape = function(s, decodeSpaces) {
-  return QueryString.unescapeBuffer(s, decodeSpaces).toString();
+  try {
+    return decodeURIComponent(s);
+  } catch (e) {
+    return QueryString.unescapeBuffer(s, decodeSpaces).toString();
+  }
 };
 
 
@@ -193,13 +197,8 @@ QueryString.parse = QueryString.decode = function(qs, sep, eq, options) {
       vstr = '';
     }
 
-    try {
-      k = decodeURIComponent(kstr);
-      v = decodeURIComponent(vstr);
-    } catch (e) {
-      k = QueryString.unescape(kstr, true);
-      v = QueryString.unescape(vstr, true);
-    }
+    k = QueryString.unescape(kstr, true);
+    v = QueryString.unescape(vstr, true);
 
     if (!hasOwnProperty(obj, k)) {
       obj[k] = v;