Skip to content

fetch: improve regexes in data-uri.js #4483

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open

fetch: improve regexes in data-uri.js #4483

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
3077aaa
fetch: improve regexes in data-uri.js
Uzlopak Aug 28, 2025
a5ce94d
Apply suggestions from code review
Uzlopak Aug 30, 2025
250de48
Update lib/web/fetch/data-url.js
Uzlopak Aug 31, 2025
809b724
merge main
Uzlopak Sep 26, 2025
8f275f1
Merge branch 'main' into regex-data-url
Uzlopak Sep 26, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 10 additions & 7 deletions lib/web/fetch/data-url.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,12 +8,13 @@ const encoder = new TextEncoder()
/**
* @see https://mimesniff.spec.whatwg.org/#http-token-code-point
*/
const HTTP_TOKEN_CODEPOINTS = /^[!#$%&'*+\-.^_|~A-Za-z0-9]+$/
const HTTP_WHITESPACE_REGEX = /[\u000A\u000D\u0009\u0020]/ // eslint-disable-line
const HTTP_TOKEN_CODEPOINTS = /^[-!#$%&'*+.^_|~A-Za-z0-9]+$/u
const HTTP_WHITESPACE_REGEX = /[\u000A\u000D\u0009\u0020]/u // eslint-disable-line

/**
* @see https://mimesniff.spec.whatwg.org/#http-quoted-string-token-code-point
*/
const HTTP_QUOTED_STRING_TOKENS = /^[\u0009\u0020-\u007E\u0080-\u00FF]+$/ // eslint-disable-line
const HTTP_QUOTED_STRING_TOKENS = /^[\u0009\u0020-\u007E\u0080-\u00FF]+$/u // eslint-disable-line

// https://fetch.spec.whatwg.org/#data-url-processor
/** @param {URL} dataURL */
Expand Down Expand Up @@ -68,7 +69,7 @@ function dataURLProcessor (dataURL) {
// 11. If mimeType ends with U+003B (;), followed by
// zero or more U+0020 SPACE, followed by an ASCII
// case-insensitive match for "base64", then:
if (/;(\u0020){0,}base64$/i.test(mimeType)) {
if (/;(?:\u0020*)base64$/ui.test(mimeType)) {
// 1. Let stringBody be the isomorphic decode of body.
const stringBody = isomorphicDecode(body)

Expand All @@ -86,7 +87,7 @@ function dataURLProcessor (dataURL) {

// 5. Remove trailing U+0020 SPACE code points from mimeType,
// if any.
mimeType = mimeType.replace(/(\u0020)+$/, '')
mimeType = mimeType.replace(/(\u0020+)$/u, '')

// 6. Remove the last U+003B (;) code point from mimeType.
mimeType = mimeType.slice(0, -1)
Expand Down Expand Up @@ -176,8 +177,9 @@ function percentDecode (input) {
/** @type {Uint8Array} */
const output = new Uint8Array(length)
let j = 0
let i = 0
// 2. For each byte byte in input:
for (let i = 0; i < length; ++i) {
while (i < length) {
const byte = input[i]

// 1. If byte is not 0x25 (%), then append byte to output.
Expand Down Expand Up @@ -205,6 +207,7 @@ function percentDecode (input) {
// 3. Skip the next two bytes in input.
i += 2
}
++i
}

// 3. Return output.
Expand Down Expand Up @@ -490,7 +493,7 @@ function serializeAMimeType (mimeType) {
if (!HTTP_TOKEN_CODEPOINTS.test(value)) {
// 1. Precede each occurrence of U+0022 (") or
// U+005C (\) in value with U+005C (\).
value = value.replace(/(\\|")/g, '\\$1')
value = value.replace(/[\\"]/ug, '\\$&')

// 2. Prepend U+0022 (") to value.
value = '"' + value
Expand Down
Loading