disclude.iojsesc 3.1.0
- Source
- https://github.com/mathiasbynens/jsesc
- Tag scanned
v3.1.0- Compared with
v3.0.2(0 signals introduced since)- Files
- 9 scanned, 2 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 43 info
- Scan time
- 4.4 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 6 of 6 warn and critical signals; 6 demoted to info.
- Disclude version
- 4.0.0
- Scanned (UTC)
- 2026-10-14 19:48
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
'\nExamples:\n', '\tjsesc \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'', '\tjsesc --json \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'', '\tjsesc --json --escape-everything \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'', -
'\tjsesc \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'', '\tjsesc --json \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'', '\tjsesc --json --escape-everything \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'', '\tjsesc --double-quotes --wrap \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'', -
'\tjsesc --json \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'', '\tjsesc --json --escape-everything \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'', '\tjsesc --double-quotes --wrap \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'', '\techo \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\' | jsesc' -
'\tjsesc --json --escape-everything \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'', '\tjsesc --double-quotes --wrap \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'', '\techo \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\' | jsesc' ].join('\n')); -
'\tjsesc --double-quotes --wrap \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'', '\techo \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\' | jsesc' ].join('\n')); return process.exit(1); -
const -
const -
-
assert. -
assert. -
assert. -
assert. -
assert. -
}), '\\0foo\\u2029bar\\nbaz\xA9qux\uD834\uDF06flops\\uD834_\\uDF06_\\uDF06\\uD834\\xA0\\u2000', 'minimal' ); -
}), '\\0foo\\u2029bar\\nbaz\xA9qux\uD834\uDF06flops\\uD834_\\uDF06_\\uDF06\\uD834\\xA0\\u2000', 'minimal' ); -
}), '\\0foo\\u2029bar\\nbaz\xA9qux\uD834\uDF06flops\\uD834_\\uDF06_\\uDF06\\uD834\\xA0\\u2000', 'minimal' ); -
}), '\\0foo\\u2029bar\\nbaz\xA9qux\uD834\uDF06flops\\uD834_\\uDF06_\\uDF06\\uD834\\xA0\\u2000', 'minimal' ); -
}), '\\0foo\\u2029bar\\nbaz\xA9qux\uD834\uDF06flops\\uD834_\\uDF06_\\uDF06\\uD834\\xA0\\u2000', 'minimal' ); -
assert. -
assert. -
assert. -
assert. -
assert. -
assert. -
'hello': 'world', '\uD83D\uDCA9': 'foo', 'pile': '\uD83D\uDCA9' }; -
'\uD83D\uDCA9': 'foo', 'pile': '\uD83D\uDCA9' }; } -
, '{"hello":"world","\\uD83D\\uDCA9":"foo","pile":"\\uD83D\\uDCA9"}', '`toJSON` methods are called when `json: true`' ); -
, '{"hello":"world","\\uD83D\\uDCA9":"foo","pile":"\\uD83D\\uDCA9"}', '`toJSON` methods are called when `json: true`' ); -
, '{"hello":"world","\\uD83D\\uDCA9":"foo","pile":"\\uD83D\\uDCA9"}', '`toJSON` methods are called when `json: true`' ); -
, '{"hello":"world","\\uD83D\\uDCA9":"foo","pile":"\\uD83D\\uDCA9"}', '`toJSON` methods are called when `json: true`' ); -
, '{"hello":"world","\\uD83D\\uDCA9":"foo","pile":"\\uD83D\\uDCA9"}', '`toJSON` methods are not called when `json: false`' ); -
, '{"hello":"world","\\uD83D\\uDCA9":"foo","pile":"\\uD83D\\uDCA9"}', '`toJSON` methods are not called when `json: false`' ); -
, '{"hello":"world","\\uD83D\\uDCA9":"foo","pile":"\\uD83D\\uDCA9"}', '`toJSON` methods are not called when `json: false`' ); -
, '{"hello":"world","\\uD83D\\uDCA9":"foo","pile":"\\uD83D\\uDCA9"}', '`toJSON` methods are not called when `json: false`' ); -
assert. -
assert. -
assert.;likely benign Test assertion that evals jsesc output to verify round-trip escaping of Unicode symbols.Reasoning
The eval is in a test file for the jsesc library, round-tripping escaped strings of Unicode symbols to verify the escaper's output. The argument is generated by jsesc from a fixed test constant, not external input. Flagged by the AST pass as a non-literal eval, but the context is a legitimate test assertion.
-
assert.likely benign Test assertion evaluating single-quoted jsesc output to check escaping correctness.Reasoning
Same jsesc round-trip test in a test suite, using single-quote wrapping on a fixed constant. No external input reaches the eval.
-
assert.likely benign Test assertion evaluating backtick-quoted jsesc output to verify escaping.Reasoning
Round-trip test of jsesc backtick-quoted output against a fixed test constant inside a test file. Eval here is the test mechanism itself.
-
assert.likely benign Test assertion evaluating wrapped jsesc output to verify round-trip correctness.Reasoning
Round-trip test of jsesc wrapped output using a fixed constant. The eval verifies that the escaped literal parses back to the original value, which is the purpose of this jsesc test.
-
assert.likely benign Test assertion evaluating double-quoted jsesc output to verify escaping.Reasoning
Double-quoted jsesc round-trip check in a test file operating on a fixed test constant. No untrusted input is involved.
-
assert.likely benign Test assertion evaluating wrapped double-quoted jsesc output to verify escaping.Reasoning
Wrapped double-quote jsesc round-trip test in a test suite using fixed data. The eval is the verification step, not a dropper or injection vector.
-
}), '[undefined,Infinity,Infinity,-Infinity,-Infinity,0,0,0,0,0,0,\'str\',function zomg() { return \'desu\'; },null,true,true,false,false,{\'foo\':42,\'hah\':[1,2,3,{\'foo\':42}]}]', 'Escaping a non-flat array with all kinds of values' );
Reproduce This Scan
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
&&