disclude.iojsesc 3.1.0
- Source
- https://github.com/mathiasbynens/jsesc
- Tag scanned
v3.1.0- Compared with
v3.0.2(0 signals introduced since)- Files
- 10 scanned, 1 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 45 info
- Scan time
- 7.7 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 8 of 8 warn and critical signals; 8 demoted to info.
- Disclude version
- 4.1.0
- Scanned (UTC)
- 2026-10-22 17:33
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
'\nExamples:\n', '\tjsesc \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'', '\tjsesc --json \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'', '\tjsesc --json --escape-everything \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'', -
'\tjsesc \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'', '\tjsesc --json \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'', '\tjsesc --json --escape-everything \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'', '\tjsesc --double-quotes --wrap \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'', -
'\tjsesc --json \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'', '\tjsesc --json --escape-everything \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'', '\tjsesc --double-quotes --wrap \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'', '\techo \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\' | jsesc' -
'\tjsesc --json --escape-everything \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'', '\tjsesc --double-quotes --wrap \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'', '\techo \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\' | jsesc' ].join('\n')); -
'\tjsesc --double-quotes --wrap \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'', '\techo \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\' | jsesc' ].join('\n')); return process.exit(1); -
const -
const -
window. &&dismissed RequireJS configuration block in the jsesc test page that sets baseUrl and cache-busting urlArgs.Reasoning
This is a RequireJS test-page configuration: window.require is checked and require is called with a config object setting baseUrl and a cache-busting urlArgs. The non-literal parts are a config value and a timestamp, not a payload loader. Standard AMD bootstrap in a test harness.
-
,);dismissed RequireJS call that loads the local tests.js module in the jsesc test page.Reasoning
The call loads the local test module 'tests.js' through RequireJS after the jsesc dependency resolves. The specifier is a fixed local path in a test page, so the finding is a false positive on AMD loading.
-
-
assert. -
assert. -
assert. -
assert. -
assert. -
}), '\\0foo\\u2029bar\\nbaz\xA9qux\uD834\uDF06flops\\uD834_\\uDF06_\\uDF06\\uD834\\xA0\\u2000', 'minimal' ); -
}), '\\0foo\\u2029bar\\nbaz\xA9qux\uD834\uDF06flops\\uD834_\\uDF06_\\uDF06\\uD834\\xA0\\u2000', 'minimal' ); -
}), '\\0foo\\u2029bar\\nbaz\xA9qux\uD834\uDF06flops\\uD834_\\uDF06_\\uDF06\\uD834\\xA0\\u2000', 'minimal' ); -
}), '\\0foo\\u2029bar\\nbaz\xA9qux\uD834\uDF06flops\\uD834_\\uDF06_\\uDF06\\uD834\\xA0\\u2000', 'minimal' ); -
}), '\\0foo\\u2029bar\\nbaz\xA9qux\uD834\uDF06flops\\uD834_\\uDF06_\\uDF06\\uD834\\xA0\\u2000', 'minimal' ); -
assert. -
assert. -
assert. -
assert. -
assert. -
assert. -
'hello': 'world', '\uD83D\uDCA9': 'foo', 'pile': '\uD83D\uDCA9' }; -
'\uD83D\uDCA9': 'foo', 'pile': '\uD83D\uDCA9' }; } -
, '{"hello":"world","\\uD83D\\uDCA9":"foo","pile":"\\uD83D\\uDCA9"}', '`toJSON` methods are called when `json: true`' ); -
, '{"hello":"world","\\uD83D\\uDCA9":"foo","pile":"\\uD83D\\uDCA9"}', '`toJSON` methods are called when `json: true`' ); -
, '{"hello":"world","\\uD83D\\uDCA9":"foo","pile":"\\uD83D\\uDCA9"}', '`toJSON` methods are called when `json: true`' ); -
, '{"hello":"world","\\uD83D\\uDCA9":"foo","pile":"\\uD83D\\uDCA9"}', '`toJSON` methods are called when `json: true`' ); -
, '{"hello":"world","\\uD83D\\uDCA9":"foo","pile":"\\uD83D\\uDCA9"}', '`toJSON` methods are not called when `json: false`' ); -
, '{"hello":"world","\\uD83D\\uDCA9":"foo","pile":"\\uD83D\\uDCA9"}', '`toJSON` methods are not called when `json: false`' ); -
, '{"hello":"world","\\uD83D\\uDCA9":"foo","pile":"\\uD83D\\uDCA9"}', '`toJSON` methods are not called when `json: false`' ); -
, '{"hello":"world","\\uD83D\\uDCA9":"foo","pile":"\\uD83D\\uDCA9"}', '`toJSON` methods are not called when `json: false`' ); -
assert. -
assert. -
assert.;likely benign Test assertion that evaluates jsesc-generated single-quoted string literals to verify round-trip escaping.Reasoning
This is a jsesc round-trip test. It evals a string built from jsesc output with single quotes and asserts the result equals the original symbols. The eval input is generated locally from a fixed test fixture, not from untrusted input. The pattern is a known test idiom for verifying escape output is valid JS.
-
assert.likely benign Test assertion evaluating single-quote jsesc output to check it round-trips to the original symbols.Reasoning
Same jsesc round-trip test as the other eval assertions: escaped output with single-quote option is evaluated and compared to the original symbol set. Input is a fixed local fixture.
-
assert.likely benign Test assertion evaluating backtick-quoted jsesc output to verify round-trip correctness.Reasoning
Round-trip test for backtick-quoted jsesc output, evaluated and compared to the source symbols. The eval input comes from a deterministic test fixture, consistent with a legitimate escaping test suite.
-
assert.likely benign Test assertion evaluating wrapped jsesc output to verify it parses and round-trips correctly.Reasoning
Round-trip test with wrap:true, so jsesc output is a complete JS expression that is eval'd and compared against the fixture. This validates the wrapped output form. No external or attacker-controlled input is involved.
-
assert.likely benign Test assertion evaluating double-quoted jsesc output to check round-trip escaping.Reasoning
Round-trip test for double-quoted jsesc output, evaluated against the original symbols. It is a deterministic test of the escaper and carries no malicious indicators.
-
assert.likely benign Test assertion evaluating wrapped double-quoted jsesc output to verify round-trip correctness.Reasoning
Double-quoted, wrap:true round-trip test of jsesc output, evaluated and compared with the fixture. This is a standard escaper test pattern, and the input is local and fixed.
-
}), '[undefined,Infinity,Infinity,-Infinity,-Infinity,0,0,0,0,0,0,\'str\',function zomg() { return \'desu\'; },null,true,true,false,false,{\'foo\':42,\'hah\':[1,2,3,{\'foo\':42}]}]', 'Escaping a non-flat array with all kinds of values' );
Reproduce This Scan
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
&&