212822 - teg-online.com - Slash characters inside regexp literals need to be escaped

Status: RESOLVED DUPLICATE of bug 309840

(Tech Evangelism Graveyard :: English US, defect)

Description

[Jim Castleberry]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4) Gecko/20030624
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4) Gecko/20030624

This page contains a regex expression that causes a javascript error:
    Error: unterminated character class [
    Source File: http://www.teg-online.com/_scriptLibrary/dredd.js
    Line: 829, Column: 12
    Source Code:
                dateExp = /^[W]\d{1,2}[/](\d{2}|\d{4})$/

Looks like the expression parser thinks the / inside square brackets
is the end of the expression.  I think the / should lose it's special
meaning inside brackets and be treated as a normal character.  That's
what sed(1) does, and that's what the author of this page expected.


Reproducible: Always

Steps to Reproduce:
1. Load the page that loads dredd.js:
http://rebates.teg-online.com/officedepot/checkstatus.asp?odserver=
2. Look at the JS console window to see the error
3.

Actual Results:  
Javascript error in the JS console, submit button on the
page doesn't work because a JS function ends up undefined
after the error

Expected Results:  
Should have parsed the expression as intended.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Does Roger's regexp rewrite fix this?

Comment 2

[zack-weg]

The syntax error is encouraged by ECMAScript (7.8.5):

--8<----

The productions below describe the syntax for a regular expression literal and
are used by the input element scanner to find the end of the regular expression
literal. The strings of characters comprising the RegularExpressionBody and the
RegularExpressionFlags are passed uninterpreted to the regular expression
constructor, which interprets them according to its own, more stringent grammar.
An implementation may extend the regular expression constructor's grammar, but
it should not extend the RegularExpressionBody and RegularExpressionFlags
productions or the productions used by these productions.

Syntax

RegularExpressionLiteral ::
  / RegularExpressionBody / RegularExpressionFlags
RegularExpressionBody ::
  RegularExpressionFirstChar RegularExpressionChars
RegularExpressionChars ::
  [empty]
  RegularExpressionChars RegularExpressionChar
RegularExpressionFirstChar ::
  NonTerminator but not * or \ or /
  BackslashSequence
RegularExpressionChar ::
  NonTerminator but not \ or /
  BackslashSequence

--8<----

BTW, it's a syntax error in Perl too.

Comment 3

[Phil Schwartau]

Have to mark this one invalid -

The problem is the use of the "/" character in the regexp literal.
This works in IE, but does not work in Perl nor in Mozilla/Netscape,
and is expressly forbidden by the ECMA-262 spec for the language.

Note that you can create regexp patterns containing "/" if you use
the RegExp constructor. However, ECMA specifically forbids the use
of "/" in RegExp literals.

For details on this, see bug 98306, particularly Comments 31-34.
Also note the Evangelism bug 101070 filed against Microsoft on this.

The ECMA-262 Edition 3 spec is at http://www.mozilla.org/js/language/

Comment 4

[Phil Schwartau]

Jim: thank you for this report. It is a good question, and 
has come up before -

Comment 5

[Brendan Eich [:brendan]]

Use a backslash before the embedded / in the literal, not the RegExp
constructor, unless you have need of a constructor otherwise.

/be

Comment 6

[Brendan Eich [:brendan]]

Is there an evang bug here, though?  Phil, what do you think?

/be

Comment 7

[Phil Schwartau]

Brendan: you're right. I'll reopen and reassign to Evangelism -

Comment 8

[Phil Schwartau]

Reassigning to Tech Evangelism and changing summary to:
"Slash characters inside regexp literals need to be escaped"

For example, the regexp given above should be corrected as follows:

 BAD:     dateExp = /^[W]\d{1,2}[/](\d{2}|\d{4})$/                      
GOOD:     dateExp = /^[W]\d{1,2}[\/](\d{2}|\d{4})$/

Note we had a similar Evangelism bug filed against Microsoft on this (bug 101070).

Comment 9

[Jesse Ruderman]

Fixed in Firefox, see bug 309840.

*** This bug has been marked as a duplicate of 309840 ***