605552 - String.replace() does not handle back references $01-$09 properly

Status: RESOLVED WONTFIX

(Tamarin Graveyard :: Virtual Machine, defect)

Description

[Brent Baker]

The String.replace(pattern, repl) function will handle back references 1-9 ($n) properly, but when you attempt to use 01-09 ($nn) it fails to fully replace the tokens in the replacement pattern. 

Example:
"one-two".replace(/(\w+)-(\w+)/g, '$02-$01')

The expected output is "two-one", but in tamarin the output is "two2-one1"

http://help.adobe.com/en_US/AS3LCR/Flash_10.0/String.html#replace%28%29
$n --> The nth captured parenthetical group match, where n is a single digit 1-9 and $n is not followed by a decimal digit.

$nn --> The nnth captured parenthetical group match, where nn is a two-digit decimal number (01-99). If the nnth capture is undefined, the replacement text is an empty string.  


This is not an injection, testcase checked against Coral versions of FP9 and FP10, marking needsversioning?

Comment 1

[Dan Smith]

Is this a problem with all multiple character values or only 1-9?  What happens with $10?

Comment 2

[Lars T Hansen]

(In reply to comment #1)
> Is this a problem with all multiple character values or only 1-9?  What
> happens with $10?

print("one-two".replace(/(\w+)-(\w+)/g, '$02-$01'));
print("one-two".replace(/(\w+)-(\w+)/g, '$2-$1'));
print("xxxxxxxxxxone-two".replace(/(x)(x)(x)(x)(x)(x)(x)(x)(x)(x)(\w+)-(\w+)/g, '$12-$11'));

prints:

two2-one1
two-one
two-one

Thus it appears $10 and so on work the way they're supposed to, it's only a problem when the match reference is prefixed with 0.

Comment 3

[Sylvestre Ledru [:Sylvestre]]

Tamarin isn't maintained anymore. WONTFIX remaining bugs.