Regex Control Character
ID |
javascript.regex_control_char |
Severity |
high |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Reliability |
Language |
JavaScript |
Tags |
reliability |
Description
Reports a raw ASCII control character embedded in a regular-expression pattern — any code point
below U+0020 other than the six a developer writes on purpose (NUL, tab, line feed, vertical tab,
form feed and carriage return). The reported range is therefore U+0001-U+0008 and
U+000E-U+001F.
Rationale
A control character is invisible. The pattern looks like it matches the text around it and in fact demands a byte that ordinary input never carries, so the match silently never happens:
const token = new RegExp("\x01[a-z]+"); // the pattern needs a literal SOH byte first
if (token.test(line)) { // never true for real input
accept(line);
}Such a character reaches the source by accident: pasted from a terminal capture, copied out of a binary protocol dump, or produced by a search-and-replace over escaped text that unescaped one level too many. Because it renders as nothing, review does not catch it and neither does the test suite when the test data was pasted from the same place.
Remediation
Decide what the pattern needed and spell it out. If the control character really is part of the input format, write it as an escape so the next reader can see it; if it is not, delete it:
const token = new RegExp("\\x01[a-z]+"); // deliberate, and visible
const plain = new RegExp("[a-z]+"); // the control character was accidentalWhat is not reported
An escape that survives into the pattern as text — "\\x01" in a new RegExp("…") argument, or
\x1b in a regex literal — is left alone: spelling the code point out is how an author says they
meant it. The six ordinary whitespace and NUL escapes are exempt in every form, because a string
escape such as "\t" decodes to the raw tab and cannot be told apart from a typed one.
Inside a regex literal a four-hex-digit Unicode escape is resolved before the pattern is analysed, so a control character written that way is reported like a raw one.