Merge pull request #839 from AikidoSec/regexp-escape

Use built-in RegExp.escape if available

Author: hansott

library/helpers/escapeStringRegexp.test.ts

@@ -1,17 +1,48 @@
 import * as t from "tap";
 import { escapeStringRegexp } from "./escapeStringRegexp";
 
-t.test("main", async (t) => {
+const isUsingBuiltIn = typeof (globalThis as any).RegExp?.escape === "function";
+
+if (!isUsingBuiltIn) {
+  t.test("main", async (t) => {
+    t.same(
+      escapeStringRegexp("\\ ^ $ * + ? . ( ) | { } [ ]"),
+      "\\\\ \\^ \\$ \\* \\+ \\? \\. \\( \\) \\| \\{ \\} \\[ \\]"
+    );
+    t.same(escapeStringRegexp("hello world"), "hello world");
+  });
+
+  t.test("escapes `-` in a way compatible with PCRE", async (t) => {
+    t.same(escapeStringRegexp("foo - bar"), "foo \\x2d bar");
+  });
+
+  t.test("escapes `-` in a way compatible with the Unicode flag", async (t) => {
+    t.ok(new RegExp(escapeStringRegexp("-"), "u").test("-"));
+  });
+} else {
   t.same(
     escapeStringRegexp("\\ ^ $ * + ? . ( ) | { } [ ]"),
-    "\\\\ \\^ \\$ \\* \\+ \\? \\. \\( \\) \\| \\{ \\} \\[ \\]"
+    "\\\\\\x20\\^\\x20\\$\\x20\\*\\x20\\+\\x20\\?\\x20\\.\\x20\\(\\x20\\)\\x20\\|\\x20\\{\\x20\\}\\x20\\[\\x20\\]"
   );
-});
 
-t.test("escapes `-` in a way compatible with PCRE", async (t) => {
-  t.same(escapeStringRegexp("foo - bar"), "foo \\x2d bar");
-});
+  t.test("escapes `-` in a way compatible with PCRE", async (t) => {
+    t.same(escapeStringRegexp("foo - bar"), "\\x66oo\\x20\\x2d\\x20bar");
+  });
 
-t.test("escapes `-` in a way compatible with the Unicode flag", async (t) => {
-  t.ok(new RegExp(escapeStringRegexp("-"), "u").test("-"));
+  t.test("escapes `-` in a way compatible with the Unicode flag", async (t) => {
+    t.ok(new RegExp(escapeStringRegexp("-"), "u").test("-"));
+  });
+}
+
+t.test("escaped regex matches correctly", async (t) => {
+  t.ok(new RegExp(escapeStringRegexp("hello world")).test("hello world"));
+  t.ok(
+    new RegExp(escapeStringRegexp("hello world \\d")).test("hello world \\d")
+  );
+  t.ok(new RegExp(escapeStringRegexp("hello\\sworld")).test("hello\\sworld"));
+
+  t.notOk(
+    new RegExp(escapeStringRegexp("hello world \\d")).test("hello world 1")
+  );
+  t.notOk(new RegExp(escapeStringRegexp("hello\\sworld")).test("hello sworld"));
 });

library/helpers/escapeStringRegexp.ts

@@ -1,10 +1,24 @@
+let funcToExport: (string: string) => string;
+
 /**
  * Escape characters with special meaning either inside or outside character sets.
  *
  * Use a simple backslash escape when it’s always valid, and a `\xnn` escape when the simpler form would be disallowed by Unicode patterns’ stricter grammar.
  *
  * Taken from https://github.com/sindresorhus/escape-string-regexp/
  */
-export function escapeStringRegexp(string: string) {
+function escapeStringRegexpFallback(string: string) {
   return string.replace(/[|\\{}()[\]^$+*?.]/g, "\\$&").replace(/-/g, "\\x2d");
 }
+
+// Use native implementation if available (Node.js 24+)
+// A benchmark showed that it is up to 50% faster than the polyfill
+// @ts-expect-error Outdated Node.js types
+if (typeof RegExp?.escape === "function") {
+  // @ts-expect-error Outdated Node.js types
+  funcToExport = RegExp.escape;
+} else {
+  funcToExport = escapeStringRegexpFallback;
+}
+
+export { funcToExport as escapeStringRegexp };