search

tc39 / ecmarkup

An HTML superset/Markdown subset source format for ECMAScript and related specifications
https://tc39.es/ecmarkup/
MIT License
218 stars 62 forks source link

Structured header parameter parser is too loose #454

Open gibson042 opened 2 years ago

gibson042 commented 2 years ago

A parameter name missing leading and/or trailing _ is accepted, probably erroneously. For example, _modifiers: a Modifiers, (as currently in proposal-regexp-modifiers spec) renders like "modifiers (a Modifiers)" with the literal `visible and "modifiers" not wrapped in a` element (as currently in proposal-regexp-modifiers HTML).

The responsible code appears to be at https://github.com/tc39/ecmarkup/blob/994d663ee9245689f4d62baaffdcbfa055d5b404/src/header-parser.ts#L140

/^[A-Za-z0-9_]+ */i should probably be replaced with /^_[A-Za-z0-9]+_ */i, or maybe /^(?:_[A-Za-z0-9]+_|[A-Za-z0-9]+) */i if we want to support parameter names not wrapped in _ (which I'd personally be against). And incidentally, I also note that the i flag is redundant with A-Za-z.

bakkot commented 2 years ago

Yeah, there should be a lint rule for this. (I prefer a lint rule to outright rejecting these inputs because it's nicer to get some output while iterating.)