implode: Better invalid input validation and handling

Error on non-number codepoint, asserted before
Replace negative codepoint and surrogate range with unicode replacement character, asserted before

Fixes jqlang#1160

src/builtin.c

@@ -1201,9 +1201,20 @@ static jv f_string_indexes(jq_state *jq, jv a, jv b) {
 }
 
 static jv f_string_implode(jq_state *jq, jv a) {
+  int i;
+  int len;
   if (jv_get_kind(a) != JV_KIND_ARRAY) {
     return ret_error(a, jv_string("implode input must be an array"));
   }
+  len = jv_array_length(jv_copy(a));
+  for (i = 0; i < len; i++) {
+    jv n = jv_array_get(jv_copy(a), i);
+    if (jv_get_kind(n) != JV_KIND_NUMBER) {
+      jv_free(a);
+      return type_error(n, "codepoint must be a number");
+    }
+  }
+
   return jv_string_implode(a);
 }
 

src/jv.c

@@ -1362,7 +1362,8 @@ jv jv_string_implode(jv j) {
     assert(JVP_HAS_KIND(n, JV_KIND_NUMBER));
     int nv = jv_number_value(n);
     jv_free(n);
-    if (nv > 0x10FFFF)
+    // outside codepoint range or in utf16 surrogate pair range
+    if (nv < 0 || nv > 0x10FFFF || (nv >= 0xD800 && nv <= 0xDFFF))
       nv = 0xFFFD; // U+FFFD REPLACEMENT CHARACTER
     s = jv_string_append_codepoint(s, nv);
   }

tests/jq.test

@@ -1834,3 +1834,14 @@ null
 debug
 1
 1
+
+
+# explode/implode
+# test replacement character (65533) for outside codepoint range and 0xd800 (55296) - 0xdfff (57343) utf16 surrogate pair range
+implode|explode
+[-1,0,1,2,3,1114111,1114112,55295,55296,57343,57344]
+[65533,0,1,2,3,1114111,65533,55295,65533,65533,57344]
+
+map(try implode catch .)
+[123,["a"]]
+["implode input must be an array","string (\"a\") codepoint must be a number"]