Skip to content

fix: reject non-ASCII hex digits in \u escapes - #1348

Open
Nussu06 wants to merge 1 commit into
google:masterfrom
Nussu06:unicode-escape-hex-narrowing
Open

Nussu06 wants to merge 1 commit into
google:masterfrom
Nussu06:unicode-escape-hex-narrowing

Conversation

@Nussu06

@Nussu06 Nussu06 commented Oct 26, 2026

Copy link
Copy Markdown

jsonnet_string_parse_unicode cast each char32_t of a \uXXXX escape to unsigned char before the hex digit check, so any code point whose low byte is 0-9, A-F or a-f was taken as that digit. "\u00ŁŁ" (U+0141 truncates to 'A') unescaped to U+00AA, and Arabic-Indic or Devanagari digits behave the same way, so the source no longer shows which character the escape produces. go-jsonnet rejects these. the check now compares the full code point, and the error prints the offending character as utf-8. valid escapes are unchanged. added a test_suite golden case, which evaluated to "ª" before the fix. test_suite and ctest pass. i couldn't run test_cmd here because it needs gnu sed.

jsonnet_string_parse_unicode cast each char32_t of the escape to
unsigned char before the hex digit check, so any code point whose low
byte is a hex digit was accepted as that digit. For example "\u00ŁŁ"
(U+0141) decoded to U+00AA instead of failing. Compare the full code
point and print the offending character as UTF-8 in the error.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant