RegExp: reject \ + non-ASCII identity escapes with the u and v flags (WebKit bump for oven-sh/WebKit#577)

scripts/build/deps/webkit.ts

@@ -3,7 +3,7 @@
  * for local mode. Override via `--webkit-version=<hash>` to test a branch.
  * From https://github.com/oven-sh/WebKit releases.
  */
-export const WEBKIT_VERSION = "299c5323879e79af282d7bb7bac8b8446a0be3f3";
+export const WEBKIT_VERSION = "autobuild-preview-pr-577-91e11605";
 
 /**
  * WebKit (JavaScriptCore) — the JS engine.

test/js/bun/jsc/regexp-unicode-escape.test.ts

@@ -0,0 +1,125 @@
+import { describe, expect, test } from "bun:test";
+
+// Coverage for oven-sh/WebKit#577. RegExp.escape classified a supplementary
+// code point by its low 16 bits, and Yarr accepted "\" + any non-ASCII
+// character as an identity escape in Unicode mode.
+
+describe("RegExp.escape with supplementary code points", () => {
+  // Each low 16-bit value below is a character RegExp.escape has to escape
+  // when it stands alone. The full code point is not that character.
+  test.each([
+    { codePoint: "2002A", lowBits: "'*'" },
+    { codePoint: "20009", lowBits: "tab" },
+    { codePoint: "2002C", lowBits: "','" },
+    { codePoint: "20020", lowBits: "space" },
+    { codePoint: "12000", lowBits: "U+2000" },
+    { codePoint: "1FEFF", lowBits: "U+FEFF" },
+  ])("U+$codePoint (low 16 bits: $lowBits) passes through unchanged", ({ codePoint }) => {
+    const s = String.fromCodePoint(parseInt(codePoint, 16));
+    expect(RegExp.escape(s)).toBe(s);
+    for (const flags of ["", "u", "v"]) {
+      expect(new RegExp(RegExp.escape(s), flags).test(s)).toBe(true);
+    }
+  });
+
+  test("escaped CJK Extension B text matches itself under u and v", () => {
+    const name = "陳\u{2002A}文";
+    const hay = `abc ${name} xyz`;
+    expect(hay.search(new RegExp(RegExp.escape(name), "v"))).toBe(4);
+    expect(hay.replaceAll(new RegExp(RegExp.escape(name), "gu"), "#")).toBe("abc # xyz");
+  });
+
+  test("no supplementary code point is escaped, in any plane", () => {
+    // Every BMP code unit that RegExp.escape rewrites: SyntaxCharacter, '/',
+    // the other punctuators, ControlEscape, WhiteSpace, LineTerminator, and a
+    // sample of the surrogate range. A supplementary code point with these
+    // low 16 bits is an ordinary character.
+    const escapedLow16 = [
+      ..."^$\\.*+?()[]{}|/,-=<>#&!%:;@~'`\"\t\n\v\f\r \u00a0\u1680\u2028\u2029\u202f\u205f\u3000\ufeff",
+    ].map(c => c.charCodeAt(0));
+    for (let c = 0x2000; c <= 0x200a; c++) escapedLow16.push(c);
+    escapedLow16.push(0xd800, 0xd83d, 0xdbff, 0xdc00, 0xde00, 0xdfff);
+    for (const low of escapedLow16) {
+      expect(RegExp.escape("_" + String.fromCharCode(low))).not.toBe("_" + String.fromCharCode(low));
+    }
+
+    const changed: string[] = [];
+    for (let plane = 1; plane <= 16; plane++) {
+      for (const low of escapedLow16) {
+        const cp = (plane << 16) | low;
+        const s = String.fromCodePoint(cp);
+        if (RegExp.escape(s) !== s) changed.push("U+" + cp.toString(16));
+      }
+    }
+    for (let cp = 0x10000; cp < 0x110000; cp += 331) {
+      const s = String.fromCodePoint(cp);
+      if (RegExp.escape(s) !== s) changed.push("U+" + cp.toString(16));
+    }
+    expect(changed).toEqual([]);
+  });
+
+  test("BMP inputs are still escaped", () => {
+    expect(RegExp.escape("^$\\.*+?()[]{}|/")).toBe("\\^\\$\\\\\\.\\*\\+\\?\\(\\)\\[\\]\\{\\}\\|\\/");
+    expect(RegExp.escape(",-=<>#&!%:;@~'`\"")).toBe(
+      "\\x2c\\x2d\\x3d\\x3c\\x3e\\x23\\x26\\x21\\x25\\x3a\\x3b\\x40\\x7e\\x27\\x60\\x22",
+    );
+    expect(RegExp.escape("\t\n\v\f\r")).toBe("\\t\\n\\v\\f\\r");
+    expect(RegExp.escape(" \uFEFF\u2000\u3000")).toBe("\\x20\\ufeff\\u2000\\u3000");
+    expect(RegExp.escape("\uD800_\uDFFF")).toBe("\\ud800_\\udfff");
+    expect(RegExp.escape("test")).toBe("\\x74est");
+  });
+});
+
+describe("identity escapes in Unicode mode", () => {
+  // BMP letters, supplementary characters, each lone surrogate half, a
+  // LineTerminator and U+FEFF: none of these is a SyntaxCharacter or '/'.
+  test.each(["00E9", "00C7", "4E2D", "5B57", "1F600", "1D4B3", "D83D", "DE00", "2028", "FEFF"])(
+    '"\\\\" + U+%s is a SyntaxError with the u and v flags',
+    codePoint => {
+      const ch = String.fromCodePoint(parseInt(codePoint, 16));
+      for (const flags of ["u", "v"]) {
+        expect(() => new RegExp("\\" + ch, flags)).toThrow(SyntaxError);
+        expect(() => new RegExp("[\\" + ch + "]", flags)).toThrow(SyntaxError);
+        expect(() => new RegExp("(?:\\" + ch + ")+", flags)).toThrow(SyntaxError);
+      }
+      expect(() => new RegExp("[\\q{\\" + ch + "}]", "v")).toThrow(SyntaxError);
+      expect(() => new RegExp("[[a]--[\\" + ch + "]]", "v")).toThrow(SyntaxError);
+    },
+  );
+
+  test("SyntaxCharacter and '/' are still identity escapes", () => {
+    for (const ch of "^$\\.*+?()[]{}|/") {
+      for (const flags of ["u", "v"]) {
+        expect(new RegExp("^\\" + ch + "$", flags).test(ch)).toBe(true);
+      }
+    }
+    expect(/^[\-]$/u.test("-")).toBe(true);
+    expect(/^[\]]$/u.test("]")).toBe(true);
+    expect(/^[\&]$/v.test("&")).toBe(true);
+  });
+
+  test("NUL and ASCII characters outside the allowed set are still a SyntaxError", () => {
+    for (const flags of ["u", "v"]) {
+      expect(() => new RegExp("\\\u0000", flags)).toThrow(SyntaxError);
+      expect(() => new RegExp("\\a", flags)).toThrow(SyntaxError);
+      expect(() => new RegExp("\\q", flags)).toThrow(SyntaxError);
+      expect(() => new RegExp("\\ ", flags)).toThrow(SyntaxError);
+    }
+  });
+
+  test("an unescaped or unicode-escaped non-ASCII character still matches with u and v", () => {
+    for (const flags of ["u", "v"]) {
+      expect(new RegExp("^\u00c7$", flags).test("\u00c7")).toBe(true);
+      expect(new RegExp("^\\u00C7$", flags).test("\u00c7")).toBe(true);
+      expect(new RegExp("^\\u{1D4B3}$", flags).test("\u{1D4B3}")).toBe(true);
+      expect(new RegExp("^[\u{1D4B3}]$", flags).test("\u{1D4B3}")).toBe(true);
+    }
+  });
+
+  test("non-Unicode patterns keep the Annex B identity escape", () => {
+    for (const ch of ["\u00e9", "\u00c7", "\u4e2d", "\u{1F600}"]) {
+      expect(new RegExp("^\\" + ch + "$").test(ch)).toBe(true);
+      expect(new RegExp("^[\\" + ch + "]+$").test(ch)).toBe(true);
+    }
+  });
+});