details: https://hg.nginx.org/njs/rev/7325a6df5036
branches:
changeset: 1455:7325a6df5036
user: Dmitry Volyntsev <xeioex@nginx.com>
date: Tue Jul 07 12:23:45 2020 +0000
description:
Fixed GetSubstitution() with absent namedCaptures.

This issue was introduced in 1c729f765cfb.
Found by Clang static analyzer.

diffstat:

src/njs_string.c | 8 ++------
src/test/njs_unit_test.c | 28 +++++++++++++++++++++++++++-
2 files changed, 29 insertions(+), 7 deletions(-)

diffs (89 lines):

diff -r ceb8f0dcf48b -r 7325a6df5036 src/njs_string.c
--- a/src/njs_string.c Tue Jul 07 12:23:44 2020 +0000
+++ b/src/njs_string.c Tue Jul 07 12:23:45 2020 +0000
@@ -3414,7 +3414,7 @@ njs_string_get_substitution(njs_vm_t *vm

case '<':
r = njs_strlchr(p, end, '>');
- if (r == NULL) {
+ if (groups == NULL || njs_is_undefined(groups) || r == NULL) {
njs_chb_append(&chain, p, 2);
p += 2;
break;
@@ -3422,10 +3422,6 @@ njs_string_get_substitution(njs_vm_t *vm

p += 2;

- if (groups == NULL) {
- break;
- }
-
ret = njs_vm_value_string_set(vm, &name, p, r - p);
if (njs_slow_path(ret != NJS_OK)) {
goto exception;
@@ -3512,7 +3508,7 @@ exception:

njs_chb_destroy(&chain);

- return NJS_OK;
+ return ret;
}


diff -r ceb8f0dcf48b -r 7325a6df5036 src/test/njs_unit_test.c
--- a/src/test/njs_unit_test.c Tue Jul 07 12:23:44 2020 +0000
+++ b/src/test/njs_unit_test.c Tue Jul 07 12:23:45 2020 +0000
@@ -7502,6 +7502,12 @@ static njs_unit_test_t njs_test[] =
{ njs_str("'abcdbe'.replace('b', '|$`X$\\'|')"),
njs_str("a|aXcdbe|cdbe") },

+ { njs_str("'ABC'.replace('B', '$<g>')"),
+ njs_str("A$<g>C") },
+
+ { njs_str("'ABC'.replace('B', '$23')"),
+ njs_str("A$23C") },
+
{ njs_str("'undefined'.replace(void 0, 'x')"),
njs_str("x") },

@@ -7669,6 +7675,9 @@ static njs_unit_test_t njs_test[] =
"uri.replace(/^\\/u\\/v1\\/[^/]*\\/([^\?]*)\\?.*(mt=[^&]*).*$/, '$1|$2')"),
njs_str("bB|mt=42") },

+ { njs_str("'ABC'.replace(/B/, '$<g>')"),
+ njs_str("A$<g>C") },
+
{ njs_str("'ABC'.replace(/(?<b>B)/, '|$<b>|@$<a>@')"),
njs_str("A|B|@@C") },

@@ -7693,12 +7702,29 @@ static njs_unit_test_t njs_test[] =
njs_str("A|+|C") },

{ njs_str("var O = RegExp.prototype.exec;"
- "function mangled(s) { var r = O.call(this, s); Object.defineProperty(r, '0', {enumerable:false}); "
+ "function mangled(s) { var r = O.call(this, s);"
+ " Object.defineProperty(r, '0', {enumerable:false}); "
" return r; };"
"RegExp.prototype.exec = mangled;"
"'ABC'.replace(/(B)/, (m, p1, off, s) => `@${m}|${p1}|${off}|${s}@`)"),
njs_str("A@B|B|1|ABC@C") },

+ { njs_str("var O = RegExp.prototype.exec;"
+ "function mangled(s) { var r = O.call(this, s);"
+ " Object.defineProperty(r, 'groups', {value: {g:1}}); "
+ " return r; };"
+ "RegExp.prototype.exec = mangled;"
+ "'ABC'.replace(/(B)/, '$<g>')"),
+ njs_str("A1C") },
+
+ { njs_str("var O = RegExp.prototype.exec;"
+ "function mangled(s) { var r = O.call(this, s);"
+ " Object.defineProperty(r, 'groups', {value: {get g() {throw 'OOps'}}}); "
+ " return r; };"
+ "RegExp.prototype.exec = mangled;"
+ "'ABC'.replace(/(B)/, '$<g>')"),
+ njs_str("OOps") },
+
{ njs_str("RegExp.prototype[Symbol.replace].call()"),
njs_str("TypeError: \"this\" is not object") },

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel