fstirlitz / luaparse

A Lua parser written in JavaScript
https://fstirlitz.github.io/luaparse/
MIT License
459 stars 91 forks source link

Fail to reject an invalid literal string #128

Open bendrissou opened 1 year ago

bendrissou commented 1 year ago

The parser fails to reject the following invalid input:

return "\u{XYZ}"

Only hexadecimal digits should be allowed in the escape sequence, which is not the case in the example above.

From the Lua specification, we have:

The UTF-8 encoding of a Unicode character can be inserted in a literal string with the escape sequence \u{XXX} (note the mandatory enclosing brackets), where XXX is a sequence of one or more hexadecimal digits representing the character code point.

Can you provide feedback on this issue please.

Thanks