Skip to content
Permalink
Browse files
Should not allow malformed \x escapes
https://bugs.webkit.org/show_bug.cgi?id=79462

Reviewed by Oliver Hunt.

Source/JavaScriptCore:

* parser/Lexer.cpp:
(JSC::::parseString):
(JSC::::parseStringSlowCase):
    - Prohibit malformed '\x' escapes
* tests/mozilla/ecma/Array/15.4.5.1-1.js:
* tests/mozilla/ecma/LexicalConventions/7.7.4.js:
* tests/mozilla/ecma_2/RegExp/hex-001.js:
* tests/mozilla/js1_2/regexp/hexadecimal.js:
    - Remove erroneous test cases (correct behaviour is tested by LayoutTests/sputnik).

LayoutTests:

* fast/regex/script-tests/pcre-test-1.js:
    - Fix bad escapes in test case.
* sputnik/Conformance/07_Lexical_Conventions/7.8_Literals/7.8.4_String_Literals/S7.8.4_A4.3_T6-expected.txt:
* sputnik/Conformance/07_Lexical_Conventions/7.8_Literals/7.8.4_String_Literals/S7.8.4_A6.1_T4-expected.txt:
* sputnik/Conformance/07_Lexical_Conventions/7.8_Literals/7.8.4_String_Literals/S7.8.4_A6.2_T1-expected.txt:
* sputnik/Conformance/07_Lexical_Conventions/7.8_Literals/7.8.4_String_Literals/S7.8.4_A6.2_T2-expected.txt:
    - Check in passing results.



Canonical link: https://commits.webkit.org/96615@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@108841 268f45cc-cd09-0410-ab3c-d52691b4dbfc
  • Loading branch information
Gavin Barraclough committed Feb 24, 2012
1 parent 007797b commit 8af84ece3614baa575ad0473e6a865cbc1c929c4
@@ -1,3 +1,18 @@
2012-02-24 Gavin Barraclough <barraclough@apple.com>

Should not allow malformed \x escapes
https://bugs.webkit.org/show_bug.cgi?id=79462

Reviewed by Oliver Hunt.

* fast/regex/script-tests/pcre-test-1.js:
- Fix bad escapes in test case.
* sputnik/Conformance/07_Lexical_Conventions/7.8_Literals/7.8.4_String_Literals/S7.8.4_A4.3_T6-expected.txt:
* sputnik/Conformance/07_Lexical_Conventions/7.8_Literals/7.8.4_String_Literals/S7.8.4_A6.1_T4-expected.txt:
* sputnik/Conformance/07_Lexical_Conventions/7.8_Literals/7.8.4_String_Literals/S7.8.4_A6.2_T1-expected.txt:
* sputnik/Conformance/07_Lexical_Conventions/7.8_Literals/7.8.4_String_Literals/S7.8.4_A6.2_T2-expected.txt:
- Check in passing results.

2012-02-24 Adrienne Walker <enne@google.com>

Fix flaky tests by removing call to dumpResourceResponseMIMETypes
@@ -1036,7 +1036,7 @@ shouldBe('regex68.exec(input1);', 'results');
var input2 = "A\0Z";
var results = null;
shouldBe('regex68.exec(input2);', 'results');
var input3 = "A\0\x0\0\x0Z";
var input3 = "A\0\0\0\0Z";
var results = null;
shouldBe('regex68.exec(input3);', 'results');

@@ -1,6 +1,7 @@
CONSOLE MESSAGE: line 77: SyntaxError: \x can only be followed by a hex character sequence
S7.8.4_A4.3_T6

FAIL No error detected
PASS Expected parsing failure

TEST COMPLETE

@@ -1,6 +1,7 @@
CONSOLE MESSAGE: line 77: SyntaxError: \x can only be followed by a hex character sequence
S7.8.4_A6.1_T4

FAIL No error detected
PASS Expected parsing failure

TEST COMPLETE

@@ -1,6 +1,7 @@
CONSOLE MESSAGE: line 77: SyntaxError: \x can only be followed by a hex character sequence
S7.8.4_A6.2_T1

FAIL No error detected
PASS Expected parsing failure

TEST COMPLETE

@@ -1,6 +1,7 @@
CONSOLE MESSAGE: line 77: SyntaxError: \x can only be followed by a hex character sequence
S7.8.4_A6.2_T2

FAIL No error detected
PASS Expected parsing failure

TEST COMPLETE

@@ -1,3 +1,20 @@
2012-02-24 Gavin Barraclough <barraclough@apple.com>

Should not allow malformed \x escapes
https://bugs.webkit.org/show_bug.cgi?id=79462

Reviewed by Oliver Hunt.

* parser/Lexer.cpp:
(JSC::::parseString):
(JSC::::parseStringSlowCase):
- Prohibit malformed '\x' escapes
* tests/mozilla/ecma/Array/15.4.5.1-1.js:
* tests/mozilla/ecma/LexicalConventions/7.7.4.js:
* tests/mozilla/ecma_2/RegExp/hex-001.js:
* tests/mozilla/js1_2/regexp/hexadecimal.js:
- Remove erroneous test cases (correct behaviour is tested by LayoutTests/sputnik).

2012-02-24 Daniel Bates <dbates@webkit.org>

Fix change log entry for changeset r108819; add bug URL
@@ -692,14 +692,15 @@ template <bool shouldBuildStrings> ALWAYS_INLINE bool Lexer<T>::parseString(JSTo
shiftLineTerminator();
else if (m_current == 'x') {
shift();
if (isASCIIHexDigit(m_current) && isASCIIHexDigit(peek(1))) {
int prev = m_current;
shift();
if (shouldBuildStrings)
record8(convertHex(prev, m_current));
shift();
} else if (shouldBuildStrings)
record8('x');
if (!isASCIIHexDigit(m_current) || !isASCIIHexDigit(peek(1))) {
m_lexErrorMessage = "\\x can only be followed by a hex character sequence";
return false;
}
int prev = m_current;
shift();
if (shouldBuildStrings)
record8(convertHex(prev, m_current));
shift();
} else {
setOffset(startingOffset);
setLineNumber(startingLineNumber);
@@ -756,14 +757,15 @@ template <bool shouldBuildStrings> bool Lexer<T>::parseStringSlowCase(JSTokenDat
shiftLineTerminator();
else if (m_current == 'x') {
shift();
if (isASCIIHexDigit(m_current) && isASCIIHexDigit(peek(1))) {
int prev = m_current;
shift();
if (shouldBuildStrings)
record16(convertHex(prev, m_current));
shift();
} else if (shouldBuildStrings)
record16('x');
if (!isASCIIHexDigit(m_current) || !isASCIIHexDigit(peek(1))) {
m_lexErrorMessage = "\\x can only be followed by a hex character sequence";
return false;
}
int prev = m_current;
shift();
if (shouldBuildStrings)
record16(convertHex(prev, m_current));
shift();
} else if (m_current == 'u') {
shift();
int character = getUnicodeCharacter();
@@ -104,6 +104,8 @@ function getTestCases() {


for ( var i = 0X0020, TEST_STRING = "var A = new Array( " ; i < 0x00ff; i++ ) {
if ( i === 0x58 || i === 0x78 ) // x or X - skip testing invalid hex escapes.
continue;
TEST_STRING += "\'\\"+ String.fromCharCode( i ) +"\'";
if ( i < 0x00FF - 1 ) {
TEST_STRING += ",";
@@ -112,7 +114,7 @@ function getTestCases() {
}
}

var LENGTH = 0x00ff - 0x0020;
var LENGTH = 0x00ff - 0x0020 - 2; // x & X

array[item++] = new TestCase( SECTION,
TEST_STRING +" A[150] = 'hello'; A[150]",
@@ -170,9 +170,9 @@ function getTestCases() {
array[item++] = new TestCase( SECTION, "\\x0F0", String.fromCharCode(15)+"0", "\x0F0" );

// G is out of hex range

array[item++] = new TestCase( SECTION, "\\xG", "xG", "\xG" );
array[item++] = new TestCase( SECTION, "\\xCG", "xCG", "\xCG" );
// Invalid hex escapes are syntax error; these are covered in the sputnik test suite.
// array[item++] = new TestCase( SECTION, "\\xG", "xG", "\xG" );
// array[item++] = new TestCase( SECTION, "\\xCG", "xCG", "\xCG" );

// DoubleStringCharacter::EscapeSequence::CharacterEscapeSequence::\ NonEscapeCharacter
array[item++] = new TestCase( SECTION, "\\a", "a", "\a" );
@@ -193,7 +193,8 @@ function getTestCases() {
array[item++] = new TestCase( SECTION, "\\u", "u", "\u" );

array[item++] = new TestCase( SECTION, "\\w", "w", "\w" );
array[item++] = new TestCase( SECTION, "\\x", "x", "\x" );
// Invalid hex escapes are syntax error; these are covered in the sputnik test suite.
// array[item++] = new TestCase( SECTION, "\\x", "x", "\x" );
array[item++] = new TestCase( SECTION, "\\y", "y", "\y" );
array[item++] = new TestCase( SECTION, "\\z", "z", "\z" );
array[item++] = new TestCase( SECTION, "\\9", "9", "\9" );
@@ -16,7 +16,8 @@

AddRegExpCases( new RegExp("\x41"), "new RegExp('\\x41')", "A", "A", 1, 0, ["A"] );
AddRegExpCases( new RegExp("\x412"),"new RegExp('\\x412')", "A2", "A2", 1, 0, ["A2"] );
AddRegExpCases( new RegExp("\x1g"), "new RegExp('\\x1g')", "x1g","x1g", 1, 0, ["x1g"] );
// Invalid hex escapes are syntax error; these are covered in the sputnik test suite.
// AddRegExpCases( new RegExp("\x1g"), "new RegExp('\\x1g')", "x1g","x1g", 1, 0, ["x1g"] );

AddRegExpCases( new RegExp("A"), "new RegExp('A')", "\x41", "\\x41", 1, 0, ["A"] );
AddRegExpCases( new RegExp("A"), "new RegExp('A')", "\x412", "\\x412", 1, 0, ["A"] );
@@ -30,7 +30,7 @@
var SECTION = 'As described in Netscape doc "Whats new in JavaScript 1.2"';
var VERSION = 'no version';
startTest();
var TITLE = 'RegExp: \x# (hex) ';
var TITLE = 'RegExp: \\x# (hex) ';

writeHeaderToLog('Executing script: hexadecimal.js');
writeHeaderToLog( SECTION + " "+ TITLE);

0 comments on commit 8af84ec

Please sign in to comment.