Filter to valid surrogate pairs (#56)

* filter to valid surrogate pairs

* handle out of range

Author: guybedford

lexer.js

@@ -52,15 +52,33 @@ function parseCJS (source, name = '@') {
   return result;
 }
 
-function decode (name) {
-  if (name[0] === '"' || name[0] === "'") {
+function decode (str) {
+  if (str[0] === '"' || str[0] === '\'') {
     try {
-      return (0, eval)(name);
+      const decoded = (0, eval)(str);
+      // Filter to exclude non-matching UTF-16 surrogate strings
+      for (let i = 0; i < decoded.length; i++) {
+        const surrogatePrefix = decoded.charCodeAt(i) & 0xFC00;
+        if (surrogatePrefix < 0xD800) {
+          // Not a surrogate
+          continue;
+        }
+        else if (surrogatePrefix === 0xD800) {
+          // Validate surrogate pair
+          if ((decoded.charCodeAt(++i) & 0xFC00) !== 0xDC00)
+            return;
+        }
+        else {
+          // Out-of-range surrogate code (above 0xD800)
+          return;
+        }
+      }
+      return decoded;
     }
     catch {}
   }
   else {
-    return name;
+    return str;
   }
 }
 

src/lexer.js

@@ -40,7 +40,25 @@ export function parse (source, name = '@') {
 function decode (str) {
   if (str[0] === '"' || str[0] === '\'') {
     try {
-      return (0, eval)(str);
+      const decoded = (0, eval)(str);
+      // Filter to exclude non-matching UTF-16 surrogate strings
+      for (let i = 0; i < decoded.length; i++) {
+        const surrogatePrefix = decoded.charCodeAt(i) & 0xFC00;
+        if (surrogatePrefix < 0xD800) {
+          // Not a surrogate
+          continue;
+        }
+        else if (surrogatePrefix === 0xD800) {
+          // Validate surrogate pair
+          if ((decoded.charCodeAt(++i) & 0xFC00) !== 0xDC00)
+            return;
+        }
+        else {
+          // Out-of-range surrogate code (above 0xD800)
+          return;
+        }
+      }
+      return decoded;
     }
     catch {}
   }

test/_unit.js

@@ -494,7 +494,6 @@ suite('Lexer', () => {
       'ab cd',
       'not identifier',
       '\u{D83C}\u{DF10}',
-      '\u{D83C}',
       '\'',
       '@notidentifier',
       '%notidentifier',