fix: Handle invalid unicode escapes

eemeli · eemeli · commit e1a1a7735ff2 · 2026-05-02T10:01:41.000+03:00
diff --git a/src/compose/resolve-flow-scalar.ts b/src/compose/resolve-flow-scalar.ts
@@ -164,7 +164,7 @@ function doubleQuotedValue(source: string, onError: FlowScalarErrorHandler) {
         next = source[++i + 1]
         while (next === ' ' || next === '\t') next = source[++i + 1]
       } else if (next === 'x' || next === 'u' || next === 'U') {
-        const length = { x: 2, u: 4, U: 8 }[next]
+        const length = next === 'x' ? 2 : next === 'u' ? 4 : 8
         res += parseCharCode(source, i + 1, length, onError)
         i += length
       } else {
@@ -235,10 +235,11 @@ function parseCharCode(
   const cc = source.substr(offset, length)
   const ok = cc.length === length && /^[0-9a-fA-F]+$/.test(cc)
   const code = ok ? parseInt(cc, 16) : NaN
-  if (isNaN(code)) {
+  try {
+    return String.fromCodePoint(code)
+  } catch {
     const raw = source.substr(offset - 2, length + 2)
     onError(offset - 2, 'BAD_DQ_ESCAPE', `Invalid escape sequence ${raw}`)
     return raw
   }
-  return String.fromCodePoint(code)
 }
diff --git a/tests/doc/errors.ts b/tests/doc/errors.ts
@@ -58,6 +58,18 @@ describe('block scalars', () => {
   })
 })
 
+describe('flow scalars', () => {
+  test('invalid hex escapes', () => {
+    const doc = YAML.parseDocument('"\\x0"')
+    expect(doc.errors).toMatchObject([{ code: 'BAD_DQ_ESCAPE' }])
+  })
+
+  test('invalid unicode escapes', () => {
+    const doc = YAML.parseDocument('"\\U00110000"')
+    expect(doc.errors).toMatchObject([{ code: 'BAD_DQ_ESCAPE' }])
+  })
+})
+
 describe('block collections', () => {
   test('mapping with bad indentation', () => {
     const src = 'foo: "1"\n bar: 2\n'
