Skip to content

fix(glob): wrap RegExp compilation in try/catch and recurse compileFragment for brace alternatives - #66

Open
fuleinist wants to merge 1 commit into
ragilhadi:masterfrom
fuleinist:fix/glob-syntax-error-safety
Open

fix(glob): wrap RegExp compilation in try/catch and recurse compileFragment for brace alternatives#66
fuleinist wants to merge 1 commit into
ragilhadi:masterfrom
fuleinist:fix/glob-syntax-error-safety

Conversation

@fuleinist

Copy link
Copy Markdown

Summary

The glob pattern compiler had two safety gaps:

  1. Brace alternatives used escapeRegex(), which escapes * and ? but those are valid glob wildcards inside braces. This caused patterns like **/{*.ts,*.tsx} to crash with SyntaxError ("Nothing to repeat") instead of compiling correctly. Fix: use compileFragment() recursively for each alternative so * and ? get proper glob handling.

  2. The new RegExp() call in compileGlobPattern() was not guarded, so any invalid regex source (e.g. from reversed character-class ranges like [z-a]) would leak a raw SyntaxError to the caller instead of the expected GlobPatternError. Fix: wrap in try/catch and rethrow as GlobPatternError.

Test Plan

  • **/{*.ts,*.tsx} compiles and matches correctly
  • {src/a*.ts,src/b.ts} compiles and matches correctly
  • [z-a].ts throws GlobPatternError (not SyntaxError)
  • {*.ts throws GlobPatternError (not SyntaxError)
  • Existing tests pass

Fixes #52

…agment for brace alternatives

The glob pattern compiler had two safety gaps:

1. Brace alternatives used escapeRegex(), which escapes * and ? but
   those are valid glob wildcards inside braces. This caused patterns
   like **/{*.ts,*.tsx} to crash with SyntaxError ("Nothing to repeat")
   instead of compiling correctly. Fix: use compileFragment() recursively
   for each alternative so * and ? get proper glob handling.

2. The new RegExp() call in compileGlobPattern() was not guarded, so
   any invalid regex source (e.g. from reversed character-class ranges
   like [z-a]) would leak a raw SyntaxError to the caller instead of
   the expected GlobPatternError. Fix: wrap in try/catch and rethrow
   as GlobPatternError.

Fixes ragilhadi#52
@fuleinist

Copy link
Copy Markdown
Author

Small housekeeping note: I closed #67 as a duplicate of this PR — both fixed the same two issues in glob-pattern.ts, and this one was filed first with slightly broader test coverage (unclosed-brace case + original SyntaxError message preserved in the thrown GlobPatternError).

Re-verified the branch against current master today: pnpm typecheck (tsc -b) clean, biome check clean, and file-list-tools.test.ts passes 17/17 including the new brace-wildcard and reversed-character-class regression tests. Still mergeable — gentle ping for review when you have a moment. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] Brace and character-class globs crash with a raw SyntaxError instead of a GlobPatternError

1 participant