fix: don't backslash-escape non-syntax characters (invalid escape with POSIX classes)

src/ast.ts

@@ -169,8 +169,16 @@ const addPatternStart = new Set(['[', '.'])
 // cases where traversal is A-OK, no dot prevention needed
 const justDots = new Set(['..', '.'])
 const reSpecials = new Set('().*{}+?[]^$\\!')
-const regExpEscape = (s: string) =>
-  s.replace(/[-[\]{}()*+?.,\\^$|#\s]/g, '\\$&')
+// Only escape characters that are actually regular expression syntax outside
+// of a character class, which is the only context this output is used in.
+// `,` `-` `#` and whitespace are literals there, and backslash-escaping them
+// produces an "Invalid escape" SyntaxError as soon as the `u` flag is set,
+// which happens whenever a pattern contains a POSIX class like `[[:digit:]]`.
+// (`-` is only special inside a class, `,` only inside a `{n,m}` quantifier -
+// unreachable here because `{` and `}` are themselves escaped - and `#` and
+// whitespace only under the `x` flag, which JavaScript does not have.)
+export const regExpEscape = (s: string) =>
+  s.replace(/[[\]{}()*+?.\\^$|]/g, '\\$&')
 
 // any single thing other than /
 const qmark = '[^/]'

src/index.ts

@@ -1,7 +1,7 @@
 import { expand } from 'brace-expansion'
 import { assertValidPattern } from './assert-valid-pattern.js'
 import type { ExtglobType } from './ast.js'
-import { AST } from './ast.js'
+import { AST, regExpEscape } from './ast.js'
 import { escape } from './escape.js'
 import { unescape } from './unescape.js'
 
@@ -374,8 +374,6 @@ minimatch.match = match
 
 // replace stuff like \* with *
 const globMagic = /[?*]|[+@!]\(.*?\)|\[|\]/
-const regExpEscape = (s: string) =>
-  s.replace(/[-[\]{}()*+?.,\\^$|#\s]/g, '\\$&')
 
 export type MMRegExp = RegExp & {
   _src?: string

tap-snapshots/test/basic.js.test.cjs

@@ -3464,11 +3464,11 @@ exports[`test/basic.js > TAP > basic tests > makeRe ?.js 4`] = `
 `
 
 exports[`test/basic.js > TAP > basic tests > makeRe ?(x-!(y)|z) 1`] = `
-/^(?:x\\-(?:(?!(?:y(?:$|\\/)))[^/]*?)|z)?$/
+/^(?:x-(?:(?!(?:y(?:$|\\/)))[^/]*?)|z)?$/
 `
 
 exports[`test/basic.js > TAP > basic tests > makeRe ?(x-!(y)|z)b 1`] = `
-/^(?:x\\-(?:(?!(?:yb(?:$|\\/)))[^/]*?)|z)?b$/
+/^(?:x-(?:(?!(?:yb(?:$|\\/)))[^/]*?)|z)?b$/
 `
 
 exports[`test/basic.js > TAP > basic tests > makeRe ?***?**** 1`] = `
@@ -3636,7 +3636,7 @@ exports[`test/basic.js > TAP > basic tests > makeRe [\\z-a] 1`] = `
 `
 
 exports[`test/basic.js > TAP > basic tests > makeRe [#a* 1`] = `
-/^\\[\\#a[^/]*?$/
+/^\\[#a[^/]*?$/
 `
 
 exports[`test/basic.js > TAP > basic tests > makeRe [^a-c]* 1`] = `
@@ -3940,7 +3940,7 @@ false
 `
 
 exports[`test/basic.js > TAP > basic tests > makeRe #* 1`] = `
-/^\\#[^/]*?$/
+/^#[^/]*?$/
 `
 
 exports[`test/basic.js > TAP > basic tests > makeRe +(?) 1`] = `
@@ -4096,7 +4096,7 @@ exports[`test/basic.js > TAP > basic tests > makeRe a/[2015-03-10T00:23:08.647Z]
 `
 
 exports[`test/basic.js > TAP > basic tests > makeRe a/[2015-03-10T00:23:08.647Z\\]/z 1`] = `
-/^a\\/\\[2015\\-03\\-10T00:23:08\\.647Z\\]\\/z$/
+/^a\\/\\[2015-03-10T00:23:08\\.647Z\\]\\/z$/
 `
 
 exports[`test/basic.js > TAP > basic tests > makeRe a/*/b 1`] = `

tap-snapshots/test/escape-has-magic.js.test.cjs

@@ -229,7 +229,7 @@ exports[`test/escape-has-magic.js > TAP > ?(x-!(y)|z) 1`] = `
 Array [
   Array [
     Array [
-      /^(?:x\\-(?:(?!(?:y(?:$|\\/)))[^/]*?)|z)?$/,
+      /^(?:x-(?:(?!(?:y(?:$|\\/)))[^/]*?)|z)?$/,
     ],
   ],
   true,
@@ -240,7 +240,7 @@ exports[`test/escape-has-magic.js > TAP > ?(x-!(y)|z)b 1`] = `
 Array [
   Array [
     Array [
-      /^(?:x\\-(?:(?!(?:yb(?:$|\\/)))[^/]*?)|z)?b$/,
+      /^(?:x-(?:(?!(?:yb(?:$|\\/)))[^/]*?)|z)?b$/,
     ],
   ],
   true,
@@ -724,7 +724,7 @@ exports[`test/escape-has-magic.js > TAP > [#a* 1`] = `
 Array [
   Array [
     Array [
-      /^\\[\\#a[^/]*?$/,
+      /^\\[#a[^/]*?$/,
     ],
   ],
   true,
@@ -1611,7 +1611,7 @@ exports[`test/escape-has-magic.js > TAP > #* 1`] = `
 Array [
   Array [
     Array [
-      /^\\#[^/]*?$/,
+      /^#[^/]*?$/,
     ],
   ],
   true,

tap-snapshots/test/optimization-level-0.ts.test.cjs

@@ -3464,11 +3464,11 @@ exports[`test/optimization-level-0.ts > TAP > basic tests > makeRe ?.js 4`] = `
 `
 
 exports[`test/optimization-level-0.ts > TAP > basic tests > makeRe ?(x-!(y)|z) 1`] = `
-/^(?:x\\-(?:(?!(?:y(?:$|\\/)))[^/]*?)|z)?$/
+/^(?:x-(?:(?!(?:y(?:$|\\/)))[^/]*?)|z)?$/
 `
 
 exports[`test/optimization-level-0.ts > TAP > basic tests > makeRe ?(x-!(y)|z)b 1`] = `
-/^(?:x\\-(?:(?!(?:yb(?:$|\\/)))[^/]*?)|z)?b$/
+/^(?:x-(?:(?!(?:yb(?:$|\\/)))[^/]*?)|z)?b$/
 `
 
 exports[`test/optimization-level-0.ts > TAP > basic tests > makeRe ?***?**** 1`] = `
@@ -3636,7 +3636,7 @@ exports[`test/optimization-level-0.ts > TAP > basic tests > makeRe [\\z-a] 1`] =
 `
 
 exports[`test/optimization-level-0.ts > TAP > basic tests > makeRe [#a* 1`] = `
-/^\\[\\#a[^/]*?$/
+/^\\[#a[^/]*?$/
 `
 
 exports[`test/optimization-level-0.ts > TAP > basic tests > makeRe [^a-c]* 1`] = `
@@ -3940,7 +3940,7 @@ false
 `
 
 exports[`test/optimization-level-0.ts > TAP > basic tests > makeRe #* 1`] = `
-/^\\#[^/]*?$/
+/^#[^/]*?$/
 `
 
 exports[`test/optimization-level-0.ts > TAP > basic tests > makeRe +(?) 1`] = `
@@ -4096,7 +4096,7 @@ exports[`test/optimization-level-0.ts > TAP > basic tests > makeRe a/[2015-03-10
 `
 
 exports[`test/optimization-level-0.ts > TAP > basic tests > makeRe a/[2015-03-10T00:23:08.647Z\\]/z 1`] = `
-/^a\\/\\[2015\\-03\\-10T00:23:08\\.647Z\\]\\/z$/
+/^a\\/\\[2015-03-10T00:23:08\\.647Z\\]\\/z$/
 `
 
 exports[`test/optimization-level-0.ts > TAP > basic tests > makeRe a/*/b 1`] = `

tap-snapshots/test/optimization-level-2.ts.test.cjs

@@ -3464,11 +3464,11 @@ exports[`test/optimization-level-2.ts > TAP > basic tests > makeRe ?.js 4`] = `
 `
 
 exports[`test/optimization-level-2.ts > TAP > basic tests > makeRe ?(x-!(y)|z) 1`] = `
-/^(?:x\\-(?:(?!(?:y(?:$|\\/)))[^/]*?)|z)?$/
+/^(?:x-(?:(?!(?:y(?:$|\\/)))[^/]*?)|z)?$/
 `
 
 exports[`test/optimization-level-2.ts > TAP > basic tests > makeRe ?(x-!(y)|z)b 1`] = `
-/^(?:x\\-(?:(?!(?:yb(?:$|\\/)))[^/]*?)|z)?b$/
+/^(?:x-(?:(?!(?:yb(?:$|\\/)))[^/]*?)|z)?b$/
 `
 
 exports[`test/optimization-level-2.ts > TAP > basic tests > makeRe ?***?**** 1`] = `
@@ -3636,7 +3636,7 @@ exports[`test/optimization-level-2.ts > TAP > basic tests > makeRe [\\z-a] 1`] =
 `
 
 exports[`test/optimization-level-2.ts > TAP > basic tests > makeRe [#a* 1`] = `
-/^\\[\\#a[^/]*?$/
+/^\\[#a[^/]*?$/
 `
 
 exports[`test/optimization-level-2.ts > TAP > basic tests > makeRe [^a-c]* 1`] = `
@@ -3940,7 +3940,7 @@ false
 `
 
 exports[`test/optimization-level-2.ts > TAP > basic tests > makeRe #* 1`] = `
-/^\\#[^/]*?$/
+/^#[^/]*?$/
 `
 
 exports[`test/optimization-level-2.ts > TAP > basic tests > makeRe +(?) 1`] = `
@@ -4096,7 +4096,7 @@ exports[`test/optimization-level-2.ts > TAP > basic tests > makeRe a/[2015-03-10
 `
 
 exports[`test/optimization-level-2.ts > TAP > basic tests > makeRe a/[2015-03-10T00:23:08.647Z\\]/z 1`] = `
-/^a\\/\\[2015\\-03\\-10T00:23:08\\.647Z\\]\\/z$/
+/^a\\/\\[2015-03-10T00:23:08\\.647Z\\]\\/z$/
 `
 
 exports[`test/optimization-level-2.ts > TAP > basic tests > makeRe a/*/b 1`] = `

test/defaults.js

@@ -82,8 +82,7 @@ t.test('call defaults mm function', t => {
   t.same(['x', '#nc', 'y'].filter(f), ['#nc'])
   t.same(defmm.match(['x', '#nc', 'y'], '#nc'), ['#nc'])
   t.same(defmm.braceExpand('# {a,b}'), ['# a', '# b'])
-  //oxlint-disable-next-linex no-useless-escape
-  t.same(defmm.makeRe('# {a,b}'), /^(?:\#\ a|\#\ b)$/)
+  t.same(defmm.makeRe('# {a,b}'), /^(?:# a|# b)$/)
   t.end()
 })
 

test/posix-class-escape.js

@@ -0,0 +1,62 @@
+// https://github.com/isaacs/minimatch/issues/273
+//
+// A POSIX class such as `[[:space:]]` compiles to `\p{...}`, which forces the
+// `u` flag on the generated regular expression. Under that flag only syntax
+// characters may be backslash-escaped, so escaping `,` `-` `#` or whitespace
+// made the pattern throw `SyntaxError: Invalid escape`.
+import t from 'tap'
+import { makeRe, minimatch } from '../dist/esm/index.js'
+
+// Every printable ASCII character, in the same path portion as a POSIX class.
+t.test('no character throws when combined with a POSIX class', t => {
+  for (let c = 0x20; c < 0x7f; c++) {
+    const ch = String.fromCharCode(c)
+    const pattern = `a${ch}b[[:digit:]]`
+    t.doesNotThrow(
+      () => minimatch('x', pattern),
+      `pattern ${JSON.stringify(pattern)}`,
+    )
+  }
+  t.end()
+})
+
+t.test('the reported pattern matches instead of throwing', t => {
+  t.equal(minimatch('foo', ',[[:space:]]'), false)
+  t.equal(minimatch(', ', ',[[:space:]]'), true)
+  t.equal(minimatch(',x', ',[[:space:]]'), false)
+  t.end()
+})
+
+t.test('the affected characters still match literally', t => {
+  t.equal(minimatch('a,1', 'a,[[:digit:]]'), true)
+  t.equal(minimatch('a-1', 'a-[[:digit:]]'), true)
+  t.equal(minimatch('a#1', 'a#[[:digit:]]'), true)
+  t.equal(minimatch('a 1', 'a [[:digit:]]'), true)
+  t.equal(minimatch('a-b', 'a-b'), true)
+  t.equal(minimatch('axb', 'a-b'), false)
+  t.end()
+})
+
+// Characters that really are regex syntax must stay escaped, or a literal
+// pattern would start behaving like a regular expression.
+t.test('regex syntax characters are still escaped', t => {
+  t.equal(minimatch('a.b', 'a.b'), true)
+  t.equal(minimatch('axb', 'a.b'), false)
+  t.equal(minimatch('a{2}b', 'a{2}b'), true)
+  t.equal(minimatch('aab', 'a{2}b'), false)
+  t.equal(minimatch('a+b', 'a+b'), true)
+  t.equal(minimatch('aab', 'a+b'), false)
+  t.equal(minimatch('a$b', 'a$b'), true)
+  t.equal(minimatch('a(b)c', 'a(b)c'), true)
+  t.end()
+})
+
+// The parsed set is derived by unescaping, so an escape scheme that does not
+// round-trip would corrupt literal patterns.
+t.test('literal patterns round-trip through the parsed set', t => {
+  t.strictSame(makeRe('a,b'), /^a,b$/)
+  t.strictSame(makeRe('a-b'), /^a-b$/)
+  t.equal(minimatch('a,b', 'a,b'), true)
+  t.equal(minimatch('au002cb', 'a,b'), false)
+  t.end()
+})