[njs] Fixed GetSubstitution() with absent namedCaptures.

[Dmitry Volyntsev]

details:   https://hg.nginx.org/njs/rev/7325a6df5036
branches:  
changeset: 1455:7325a6df5036
user:      Dmitry Volyntsev <xeioex at nginx.com>
date:      Tue Jul 07 12:23:45 2020 +0000
description:
Fixed GetSubstitution() with absent namedCaptures.

This issue was introduced in 1c729f765cfb.
Found by Clang static analyzer.

diffstat:

 src/njs_string.c         |   8 ++------
 src/test/njs_unit_test.c |  28 +++++++++++++++++++++++++++-
 2 files changed, 29 insertions(+), 7 deletions(-)

diffs (89 lines):

diff -r ceb8f0dcf48b -r 7325a6df5036 src/njs_string.c
--- a/src/njs_string.c	Tue Jul 07 12:23:44 2020 +0000
+++ b/src/njs_string.c	Tue Jul 07 12:23:45 2020 +0000
@@ -3414,7 +3414,7 @@ njs_string_get_substitution(njs_vm_t *vm
 
         case '<':
             r = njs_strlchr(p, end, '>');
-            if (r == NULL) {
+            if (groups == NULL || njs_is_undefined(groups) || r == NULL) {
                 njs_chb_append(&chain, p, 2);
                 p += 2;
                 break;
@@ -3422,10 +3422,6 @@ njs_string_get_substitution(njs_vm_t *vm
 
             p += 2;
 
-            if (groups == NULL) {
-                break;
-            }
-
             ret = njs_vm_value_string_set(vm, &name, p, r - p);
             if (njs_slow_path(ret != NJS_OK)) {
                 goto exception;
@@ -3512,7 +3508,7 @@ exception:
 
     njs_chb_destroy(&chain);
 
-    return NJS_OK;
+    return ret;
 }
 
 
diff -r ceb8f0dcf48b -r 7325a6df5036 src/test/njs_unit_test.c
--- a/src/test/njs_unit_test.c	Tue Jul 07 12:23:44 2020 +0000
+++ b/src/test/njs_unit_test.c	Tue Jul 07 12:23:45 2020 +0000
@@ -7502,6 +7502,12 @@ static njs_unit_test_t  njs_test[] =
     { njs_str("'abcdbe'.replace('b', '|$`X$\\'|')"),
       njs_str("a|aXcdbe|cdbe") },
 
+    { njs_str("'ABC'.replace('B', '$<g>')"),
+      njs_str("A$<g>C") },
+
+    { njs_str("'ABC'.replace('B', '$23')"),
+      njs_str("A$23C") },
+
     { njs_str("'undefined'.replace(void 0, 'x')"),
       njs_str("x") },
 
@@ -7669,6 +7675,9 @@ static njs_unit_test_t  njs_test[] =
               "uri.replace(/^\\/u\\/v1\\/[^/]*\\/([^\?]*)\\?.*(mt=[^&]*).*$/, '$1|$2')"),
       njs_str("bB|mt=42") },
 
+    { njs_str("'ABC'.replace(/B/, '$<g>')"),
+      njs_str("A$<g>C") },
+
     { njs_str("'ABC'.replace(/(?<b>B)/, '|$<b>|@$<a>@')"),
       njs_str("A|B|@@C") },
 
@@ -7693,12 +7702,29 @@ static njs_unit_test_t  njs_test[] =
       njs_str("A|+|C") },
 
     { njs_str("var O = RegExp.prototype.exec;"
-              "function mangled(s) { var r = O.call(this, s); Object.defineProperty(r, '0', {enumerable:false}); "
+              "function mangled(s) { var r = O.call(this, s);"
+              "                      Object.defineProperty(r, '0', {enumerable:false}); "
               "                      return r; };"
               "RegExp.prototype.exec = mangled;"
               "'ABC'.replace(/(B)/, (m, p1, off, s) => `@${m}|${p1}|${off}|${s}@`)"),
       njs_str("A at B|B|1|ABC at C") },
 
+    { njs_str("var O = RegExp.prototype.exec;"
+              "function mangled(s) { var r = O.call(this, s);"
+              "                      Object.defineProperty(r, 'groups', {value: {g:1}}); "
+              "                      return r; };"
+              "RegExp.prototype.exec = mangled;"
+              "'ABC'.replace(/(B)/, '$<g>')"),
+      njs_str("A1C") },
+
+    { njs_str("var O = RegExp.prototype.exec;"
+              "function mangled(s) { var r = O.call(this, s);"
+              "                      Object.defineProperty(r, 'groups', {value: {get g() {throw 'OOps'}}}); "
+              "                      return r; };"
+              "RegExp.prototype.exec = mangled;"
+              "'ABC'.replace(/(B)/, '$<g>')"),
+      njs_str("OOps") },
+
     { njs_str("RegExp.prototype[Symbol.replace].call()"),
       njs_str("TypeError: \"this\" is not object") },