[JEXL-336] Escape some control characters

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.2
• Assignee: Henri Biestro
• Reporter: Hussachai Puripunpinyo
• Created: 01/Nov/20 06:30
• Updated: 07/Jun/21 13:15
• Resolved: 02/Jun/21 15:54

Description

I found that JEXL doesn't honor the escape control characters such as \n, \t. 

To reproduce this is simply evaluate this string "a\t\b" and it will yield "a\t\b" instead of "a   b".

The test code can explain this better. Note that I have to escape twice because one is for Java and another one is for JEXL.

String[][] strings = new String[][] {
    new String[] {"a\nb\tc", "'a\nb\tc'"}, // we still honor the actual characters
    new String[] {"a\nb\tc", "'a\\nb\\tc'"},
    new String[] {"a\nb\tc", "\"a\\nb\\tc\""},
    new String[] {"\b\t\n\f\r", "'\\b\\t\\n\\f\\r'"},
    new String[] {"'hi'", "'\\'hi\\''"},
    new String[] {"\"hi\"", "'\"hi\"'"},
    new String[] {"\"hi\"", "'\"hi\"'"},
};
for(String[] pair: strings) {
    String output = StringParser.buildString(pair[1], true);
    Assert.assertEquals(pair[0], output);
}

This change doesn't cover all control characters because it won't be used. I follow the ES5 JavaScript spec for the control characters that it supports except \v which Java itself doesn't support. I don't think it's being used that much anyway. Supporting \v is tricky. We can represent it with the unicode value (\u000B) but JEXL is Java and doing that in Java is not possible. Developers have to put the unicode in the String anyway when it's used in the host language. That's why \v is not included in the list. 

Issue Links

• links to: GitHub Pull Request #32