Avoid unescaping %uXXXX in iso-8859-1 mode

ljharb#268 (comment)

Author: papandreou

lib/utils.js

@@ -110,7 +110,8 @@ var assign = function assignSingleSource(target, source) {
 var decode = function (str, decoder, charset) {
     var strWithoutPlus = str.replace(/\+/g, ' ');
     if (charset === 'iso-8859-1') {
-        return unescape(strWithoutPlus); // Cannot throw
+        // unescape never throws, no try...catch needed:
+        return strWithoutPlus.replace(/%[0-9a-f]{2}/gi, unescape);
     }
     // utf-8
     try {

test/parse.js

@@ -627,5 +627,10 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('does not interpret %uXXXX syntax in iso-8859-1 mode', function (st) {
+        st.deepEqual(qs.parse('%u263A=%u263A', { charset: 'iso-8859-1' }), { '%u263A': '%u263A' });
+        st.end();
+    });
+
     t.end();
 });