Merge pull request #2 from carpentry-org/claude/fix-invalid-escape-sequences

Fix silent acceptance of invalid escape sequences in string parser

Author: hellerve

CHANGELOG.md

@@ -5,6 +5,10 @@ the project follows [Semantic Versioning](https://semver.org/).
 
 ## Unreleased
 
+- String parser now rejects invalid escape sequences (e.g. `\z`,
+  `\0`) with a parse error instead of silently emitting raw bytes.
+  `\u` and `\U` escapes also validate that the required hex digits
+  are actually hex characters.
 - `Form.str` uses `StringBuf` for `join-children`, `join-segments`,
   and `escape-string`, replacing O(n²) `String.append` loops with
   amortised O(n) appends. Adds a dependency on `strbuf@0.1.0`.

carp-reader.carp

@@ -528,17 +528,17 @@ there is no exponent here.")
             (let-do [c (Cursor.advance cur \")
                      bytes (the (Array Byte) [])
                      going true
-                     err false]
-              (while-do (and going (not err))
+                     err @""]
+              (while-do (and going (Int.= 0 (String.length &err)))
                 (if (Int.>= @(Cursor.pos &c) len)
-                  (set! err true)
+                  (set! err @"closing quote")
                   (let [ch (String.char-at src @(Cursor.pos &c))]
                     (cond
                       (Char.= ch \")
                         (do (set! c (Cursor.advance &c ch)) (set! going false))
                       (Char.= ch \\)
                         (if (Int.>= (Int.+ @(Cursor.pos &c) 1) len)
-                          (set! err true)
+                          (set! err @"closing quote")
                           (let [esc (String.char-at src
                                                     (Int.+ @(Cursor.pos &c) 1))]
                             (cond
@@ -600,40 +600,49 @@ there is no exponent here.")
                                                                (Int.- end
                                                                       @(Cursor.pos &c))
                                                                false)))
-                                    (set! err true)))
+                                    (set! err @"hex digits after \\x")))
                               (Char.= esc \u)
                                 (if (Int.>= (Int.+ @(Cursor.pos &c) 6)
                                             (Int.inc len))
-                                  (set! err true)
-                                  (do
-                                    (set! bytes
-                                          (push-utf8-bytes bytes
-                                                           (read-hex src
-                                                                     (Int.+ @(Cursor.pos &c)
-                                                                            2)
-                                                                     4)))
-                                    (set! c (Cursor.advance-by &c 6 false))))
+                                  (set! err @"4 hex digits in \\u escape")
+                                  (let-do [hex-start (Int.+ @(Cursor.pos &c) 2)
+                                           all-hex true]
+                                    (for [j hex-start (Int.+ hex-start 4)]
+                                      (unless (hex-digit? (String.char-at src j))
+                                        (set! all-hex false)))
+                                    (if all-hex
+                                      (do
+                                        (set! bytes
+                                              (push-utf8-bytes bytes
+                                                               (read-hex src
+                                                                         hex-start
+                                                                         4)))
+                                        (set! c (Cursor.advance-by &c 6 false)))
+                                      (set! err @"hex digits in \\u escape"))))
                               (Char.= esc \U)
                                 (if (Int.>= (Int.+ @(Cursor.pos &c) 10)
                                             (Int.inc len))
-                                  (set! err true)
-                                  (do
-                                    (set! bytes
-                                          (push-utf8-bytes bytes
-                                                           (read-hex src
-                                                                     (Int.+ @(Cursor.pos &c)
-                                                                            2)
-                                                                     8)))
-                                    (set! c (Cursor.advance-by &c 10 false))))
-                              (do
-                                (set! bytes (push-byte bytes \\))
-                                (set! bytes (push-byte bytes esc))
-                                (set! c (Cursor.advance-by &c 2 false))))))
+                                  (set! err @"8 hex digits in \\U escape")
+                                  (let-do [hex-start (Int.+ @(Cursor.pos &c) 2)
+                                           all-hex true]
+                                    (for [j hex-start (Int.+ hex-start 8)]
+                                      (unless (hex-digit? (String.char-at src j))
+                                        (set! all-hex false)))
+                                    (if all-hex
+                                      (do
+                                        (set! bytes
+                                              (push-utf8-bytes bytes
+                                                               (read-hex src
+                                                                         hex-start
+                                                                         8)))
+                                        (set! c (Cursor.advance-by &c 10 false)))
+                                      (set! err @"hex digits in \\U escape"))))
+                              (set! err @"valid escape sequence"))))
                       (do
                         (set! bytes (push-byte bytes ch))
                         (set! c (Cursor.advance &c ch)))))))
-              (if err
-                (Reply.ErrConsumed (ParseErr.expected-at &c @"closing quote"))
+              (if (Int.> (String.length &err) 0)
+                (Reply.ErrConsumed (ParseErr.expected-at &c err))
                 (Reply.OkConsumed (Form.Str (String.from-bytes &bytes)) c))))))))
 
   (private raw-string)

test/carp-reader.carp

@@ -193,6 +193,31 @@
 b\"" &(Located.str &(first-form "\"a
 b\"")) "string with literal newline stays as literal newline")
 
+  ; --- valid escape sequences in strings ---
+  (assert-equal t
+    "\"\\t\""
+    &(Located.str &(first-form "\"\\t\""))
+    "round-trip: tab escape")
+  (assert-equal t
+    "\"A\""
+    &(Located.str &(first-form "\"\\x41\""))
+    "hex escape \\x41 produces A")
+  (assert-equal t
+    "\"A\""
+    &(Located.str &(first-form "\"\\u0041\""))
+    "unicode escape \\u0041 produces A")
+
+  ; --- invalid escape sequences in strings ---
+  (assert-true t (parse-error? "\"\\z\"") "invalid escape \\z errors")
+  (assert-true t (parse-error? "\"\\q\"") "invalid escape \\q errors")
+  (assert-true t (parse-error? "\"\\0\"") "\\0 is not a valid escape")
+  (assert-true t (parse-error? "\"\\x\"") "\\x without hex digits errors")
+  (assert-true t (parse-error? "\"\\xZZ\"") "\\x with non-hex chars errors")
+  (assert-true t (parse-error? "\"\\uGHIJ\"") "\\u with non-hex chars errors")
+  (assert-true t
+    (parse-error? "\"\\U0000GHIJ\"")
+    "\\U with non-hex chars errors")
+
   ; --- error cases ---
   (assert-true t (parse-error? "(") "unbalanced open paren errors")
   (assert-true t (parse-error? "\"unterminated") "unterminated string errors"))