Prathmesh/typescript ambient modules #2528
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| '\u2029': '\\u2029', | ||
| }; | ||
| return (str) => { | ||
| const cleanString = str.replace(/["\n\r\u2028\u2029]/g, ($0) => rc[$0]); |
Check failure
Code scanning / CodeQL
Incomplete string escaping or encoding High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 18 days ago
To correctly escape characters for safe string interpolation, we should ensure that all relevant special characters, especially backslashes, are handled. The best way here is to also escape backslashes before other replacements, ensuring that any pre-existing backslashes in the input don't "escape" the subsequently added escape characters or otherwise cause malformed output.
- Add
'\\': '\\\\'to thercreplacement table. - Update the regular expression in
str.replaceto also match backslashes (\\), i.e.,["\\",...otherchars]. - No change in existing functionality—just an additional safeguard for edge cases.
- All changes are within the block beginning at line 47 (
exports.makeURLInterpolator = ...) - No new library imports are required.
| @@ -46,13 +46,14 @@ | ||
| */ | ||
| exports.makeURLInterpolator = (() => { | ||
| const rc = { | ||
| '\\': '\\\\', | ||
| '\n': '\\n', | ||
| '"': '\\"', | ||
| '\u2028': '\\u2028', | ||
| '\u2029': '\\u2029', | ||
| }; | ||
| return (str) => { | ||
| const cleanString = str.replace(/["\n\r\u2028\u2029]/g, ($0) => rc[$0]); | ||
| const cleanString = str.replace(/["\\\n\r\u2028\u2029]/g, ($0) => rc[$0]); | ||
| return (outputs) => { | ||
| return cleanString.replace(/\{([\s\S]+?)\}/g, ($0, $1) => { | ||
| const output = outputs[$1]; |
| '\u2029': '\\u2029', | ||
| }; | ||
| return (str) => { | ||
| const cleanString = str.replace(/["\n\r\u2028\u2029]/g, ($0) => rc[$0]); |
Check failure
Code scanning / CodeQL
Incomplete string escaping or encoding High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 18 days ago
The correct fix is to ensure that all backslash (\) characters in the input string are escaped before escaping the other special characters. This is most reliably done by modifying the regular expression used in str.replace to include backslashes and ensuring that backslashes are handled in the replacement callback. This means adding '\\': '\\\\' to the replacement map (rc) and including \\ in the regex: /["\\\n\r\u2028\u2029]/g. This change should be made directly at line 50, adjusting both the regex and the mapping to escape backslashes before any other character, thereby preventing double-escaping.
Only the code in esm/utils.js is affected—specifically, the makeURLInterpolator function.
| @@ -41,13 +41,14 @@ | ||
| */ | ||
| export const makeURLInterpolator = (() => { | ||
| const rc = { | ||
| '\\': '\\\\', | ||
| '\n': '\\n', | ||
| '"': '\\"', | ||
| '\u2028': '\\u2028', | ||
| '\u2029': '\\u2029', | ||
| }; | ||
| return (str) => { | ||
| const cleanString = str.replace(/["\n\r\u2028\u2029]/g, ($0) => rc[$0]); | ||
| const cleanString = str.replace(/["\\\n\r\u2028\u2029]/g, ($0) => rc[$0]); | ||
| return (outputs) => { | ||
| return cleanString.replace(/\{([\s\S]+?)\}/g, ($0, $1) => { | ||
| const output = outputs[$1]; |
prathmesh-stripe
force-pushed
the
prathmesh/typescript-ambient-modules
branch
from
bf87616 to
cbd5996
Compare
Why?
What?
See Also