String.replace() does not handle back references $01-$09 properly

NEW
Unassigned

Status

Tamarin
Virtual Machine
7 years ago
7 years ago

People

(Reporter: Brent Baker, Unassigned)

Tracking

unspecified
Future
Bug Flags:
in-testsuite +
flashplayer-injection -
flashplayer-qrb +
flashplayer-bug -
flashplayer-triage +
flashplayer-needsversioning ?

Details

(Reporter)

Description

7 years ago
The String.replace(pattern, repl) function will handle back references 1-9 ($n) properly, but when you attempt to use 01-09 ($nn) it fails to fully replace the tokens in the replacement pattern. 

Example:
"one-two".replace(/(\w+)-(\w+)/g, '$02-$01')

The expected output is "two-one", but in tamarin the output is "two2-one1"

http://help.adobe.com/en_US/AS3LCR/Flash_10.0/String.html#replace%28%29
$n --> The nth captured parenthetical group match, where n is a single digit 1-9 and $n is not followed by a decimal digit.

$nn --> The nnth captured parenthetical group match, where nn is a two-digit decimal number (01-99). If the nnth capture is undefined, the replacement text is an empty string.  


This is not an injection, testcase checked against Coral versions of FP9 and FP10, marking needsversioning?
Flags: flashplayer-triage+
Flags: flashplayer-qrb?
Flags: flashplayer-needsversioning?
Flags: flashplayer-injection-
(Reporter)

Updated

7 years ago
Flags: in-testsuite+
Flags: flashplayer-bug-

Comment 1

7 years ago
Is this a problem with all multiple character values or only 1-9?  What happens with $10?
Flags: flashplayer-qrb? → flashplayer-qrb+
Target Milestone: --- → Future

Comment 2

7 years ago
(In reply to comment #1)
> Is this a problem with all multiple character values or only 1-9?  What
> happens with $10?

print("one-two".replace(/(\w+)-(\w+)/g, '$02-$01'));
print("one-two".replace(/(\w+)-(\w+)/g, '$2-$1'));
print("xxxxxxxxxxone-two".replace(/(x)(x)(x)(x)(x)(x)(x)(x)(x)(x)(\w+)-(\w+)/g, '$12-$11'));

prints:

two2-one1
two-one
two-one

Thus it appears $10 and so on work the way they're supposed to, it's only a problem when the match reference is prefixed with 0.
You need to log in before you can comment on or make changes to this bug.