Wildcard in reloadableScripts in yii.js allows 0 characters

[arogachev]

I found this issue during writing tests for yii.js.

Currently in yii.js we have reloadableScripts property used in initScriptFilter() function. It supports wildcards since ea0c6d7:

/**
 * List of JS or CSS URLs that can be loaded multiple times via AJAX requests.
 * Each item may be represented as either an absolute URL or a relative one.
 * Each item may contain a wildcart matching character `*`, that means one or more
 * any characters on the position. For example:
 *  - `/css/*.js` will match any file ending with `.js` in the `css` directory of the current web site
 *  - `http*://cdn.example.com/*` will match any files on domain `cdn.example.com`, loaded with HTTP or HTTPS
 *  - `/js/myCustomScript.js?realm=*` will match file `/js/myCustomScript.js` with defined `realm` parameter
 */
reloadableScripts: [],

However, this statement in JSDoc:

Each item may contain a wildcart matching character *, that means one or more * any characters on the position.

contradicts with reality.

0 characters is allowed, so when we set:

yii.reloadableScripts = ['/js/*.js'];

/js/.js will be a valid combination.

Example for easier reproducing:

function escapeRegExp(str) {
    return str.replace(/[\-\[\]\/\{\}\(\)\*\+\?\.\\\^\$\|]/g, "\\$&");
}

var rule = '/js/*.js';
var url = '/js/.js';
var match = new RegExp("^" + escapeRegExp(rule).split('\\*').join('.*') + "$").test(url);

match will have a value true. Looks like a bug for me.

[samdark]

Agree it's a bug.

[arogachev]

OK, I can take a look at this, but after merging #13317 to prevent merge conficts.

[arogachev]

Sorry, I mean #13316.