@@ -55,7 +55,7 @@ function parseCJS (source, name = '@') {
5555function decode ( str ) {
5656 if ( str [ 0 ] === '"' || str [ 0 ] === '\'' ) {
5757 try {
58- const decoded = ( 0 , eval ) ( str ) ;
58+ const decoded = scanStringLiteral ( str ) ;
5959 // Filter to exclude non-matching UTF-16 surrogate strings
6060 for ( let i = 0 ; i < decoded . length ; i ++ ) {
6161 const surrogatePrefix = decoded . charCodeAt ( i ) & 0xFC00 ;
@@ -1027,6 +1027,168 @@ function tryParseLiteralExports () {
10271027 }
10281028}
10291029
1030+ // This function and it's callees are duplicated in src/lexer.js
1031+ function scanStringLiteral ( source ) {
1032+ const quote = source [ 0 ] ;
1033+
1034+ // try JSON.parse first for performance
1035+ if ( quote === '"' ) {
1036+ try {
1037+ return JSON . parse ( source ) ;
1038+ } catch {
1039+ // ignored
1040+ }
1041+ } else if ( quote === "'" && source . length > 1 && source [ source . length - 1 ] === "'" && source . indexOf ( '"' ) === - 1 ) {
1042+ try {
1043+ return JSON . parse ( '"' + source . slice ( 1 , - 1 ) + '"' ) ;
1044+ } catch {
1045+ // ignored
1046+ }
1047+ }
1048+
1049+ // fall back to doing it the hard way
1050+ let parsed = '' ;
1051+ let index = { v : 1 } ;
1052+
1053+ while ( index . v < source . length ) {
1054+ const char = source [ index . v ] ;
1055+ switch ( char ) {
1056+ case quote : {
1057+ return parsed ;
1058+ }
1059+ case '\\' : {
1060+ ++ index . v ;
1061+ parsed += scanEscapeSequence ( source , index ) ;
1062+ break ;
1063+ }
1064+ case '\r' :
1065+ case '\n' : {
1066+ throw new SyntaxError ( ) ;
1067+ }
1068+ default : {
1069+ ++ index . v ;
1070+ parsed += char ;
1071+ }
1072+ }
1073+ }
1074+
1075+ throw new SyntaxError ( ) ;
1076+ }
1077+
1078+ function scanEscapeSequence ( source , index ) {
1079+ if ( index . v === source . length ) {
1080+ throw new SyntaxError ( ) ;
1081+ }
1082+ const char = source [ index . v ] ;
1083+ ++ index . v ;
1084+ switch ( char ) {
1085+ case '\r' : {
1086+ if ( source [ index . v ] === '\n' ) {
1087+ ++ index . v ;
1088+ }
1089+ // fall through
1090+ }
1091+ case '\n' :
1092+ case '\u2028' :
1093+ case '\u2029' : {
1094+ return '' ;
1095+ }
1096+ case 'r' : {
1097+ return '\r' ;
1098+ }
1099+ case 'n' : {
1100+ return '\n' ;
1101+ }
1102+ case 't' : {
1103+ return '\t' ;
1104+ }
1105+ case 'b' : {
1106+ return '\b' ;
1107+ }
1108+ case 'f' : {
1109+ return '\f' ;
1110+ }
1111+ case 'v' : {
1112+ return '\v' ;
1113+ }
1114+ case 'x' : {
1115+ return scanHexEscapeSequence ( source , index ) ;
1116+ }
1117+ case 'u' : {
1118+ return scanUnicodeEscapeSequence ( source , index ) ;
1119+ }
1120+ case '0' :
1121+ case '1' :
1122+ case '2' :
1123+ case '3' :
1124+ case '4' :
1125+ case '5' :
1126+ case '6' :
1127+ case '7' : {
1128+ return scanOctalEscapeSequence ( char , source , index ) ;
1129+ }
1130+ default : {
1131+ return char ;
1132+ }
1133+ }
1134+ }
1135+
1136+ function scanHexEscapeSequence ( source , index ) {
1137+ const a = readHex ( source [ index . v ] ) ;
1138+ ++ index . v ;
1139+ const b = readHex ( source [ index . v ] ) ;
1140+ ++ index . v ;
1141+ return String . fromCodePoint ( a * 16 + b ) ;
1142+ }
1143+
1144+ function scanUnicodeEscapeSequence ( source , index ) {
1145+ let result = 0 ;
1146+ if ( source [ index . v ] === '{' ) {
1147+ ++ index . v ;
1148+ do {
1149+ result = result * 16 + readHex ( source [ index . v ] ) ;
1150+ if ( result > 0x10FFFF ) {
1151+ throw new SyntaxError ( ) ;
1152+ }
1153+ ++ index . v ;
1154+ } while ( source [ index . v ] !== '}' ) ;
1155+ ++ index . v ;
1156+ } else {
1157+ for ( let i = 0 ; i < 4 ; ++ i ) {
1158+ result = result * 16 + readHex ( source [ index . v ] ) ;
1159+ ++ index . v ;
1160+ }
1161+ }
1162+ return String . fromCodePoint ( result ) ;
1163+ }
1164+
1165+ function scanOctalEscapeSequence ( char , source , index ) {
1166+ let toRead = char <= '3' ? 2 : 1 ;
1167+ let result = + char ;
1168+ do {
1169+ char = source [ index . v ] ;
1170+ if ( char < '0' || char > '7' ) {
1171+ break ;
1172+ }
1173+ result = result * 8 + ( + char ) ;
1174+ ++ index . v ;
1175+ -- toRead ;
1176+ } while ( toRead > 0 ) ;
1177+ return String . fromCodePoint ( result ) ;
1178+ }
1179+
1180+ function readHex ( char ) {
1181+ if ( char >= '0' && char <= '9' ) {
1182+ return + char ;
1183+ } else if ( char >= 'a' && char <= 'f' ) {
1184+ return char . charCodeAt ( 0 ) - 87 ;
1185+ } else if ( char >= 'A' && char <= 'F' ) {
1186+ return char . charCodeAt ( 0 ) - 55 ;
1187+ }
1188+ throw new SyntaxError ( ) ;
1189+ }
1190+
1191+
10301192// --- Extracted from AcornJS ---
10311193//(https://github.com/acornjs/acorn/blob/master/acorn/src/identifier.js#L23
10321194//
0 commit comments