search

trailofbits / semgrep-rules

Semgrep queries developed by Trail of Bits.
GNU Affero General Public License v3.0
330 stars 32 forks source link

Remove unnecessary string escaping #67

Closed mschwager closed 15 hours ago

mschwager commented 1 month ago

There are two benefits here:

  1. Avoiding the need for escaping makes things more clear.
  2. This form of backslash escaping was actually only added in YAML 1.2.0. Some YAML parsers are not fully compliant with YAML 1.2.0, so they fail to parse these rules. This isn't a problem for Semgrep, but can be an issue for other tools or libraries analyzing these rules.
mschwager commented 1 month ago

Actually, it appears double quotes works without the escaping: https://github.com/trailofbits/semgrep-rules/pull/67/commits/54a018aa7a51755322594c35093efbcc41d4c99d.

I'm not sure why I thought these strings needed escaped forward slashes in the first place. Apparently forward slashes do not need to be escaped, and this was only added in YAML 1.2.0 to be backwards compatible with JSON. However, even JSON does not require forward slashes to be escaped, and the original reason for allowing it was something to do with JavaScript code 🤷.