Merge pull request #5360 from erik-krogh/regParse

Approved by asgerf
2026-05-04 05:05:12 +02:00 · 2021-03-10 05:57:19 -08:00
parent a2660e5996 29ae737475
commit 2c4ba561bf
8 changed files with 369 additions and 353 deletions
--- a/javascript/extractor/src/com/semmle/js/extractor/Main.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/Main.java
@@ -43,7 +43,7 @@ public class Main {
   * A version identifier that should be updated every time the extractor changes in such a way that
   * it may produce different tuples for the same file under the same {@link ExtractorConfig}.
   */
-  public static final String EXTRACTOR_VERSION = "2021-02-24";
+  public static final String EXTRACTOR_VERSION = "2021-03-08";

  public static final Pattern NEWLINE = Pattern.compile("\n");

--- a/javascript/extractor/src/com/semmle/js/parser/RegExpParser.java
+++ b/javascript/extractor/src/com/semmle/js/parser/RegExpParser.java
@@ -282,11 +282,18 @@ public class RegExpParser {
    if (this.match("+")) return this.finishTerm(new Plus(loc, atom, !this.match("?")));
    if (this.match("?")) return this.finishTerm(new Opt(loc, atom, !this.match("?")));
    if (this.match("{")) {
-      Double lo = toNumber(this.readDigits(false)), hi;
+      String matched = "{"; // keeping track of the string matched so far, in case this turns out not to be a quantifier.
+      String digits = this.readDigits(false);
+      matched += digits;
+      Double lo = toNumber(digits), hi;
+      int prevPos = this.pos;
      if (this.match(",")) {
+        matched += ",";
        if (!this.lookahead("}")) {
          // atom{lo, hi}
-          hi = toNumber(this.readDigits(false));
+          digits = this.readDigits(false);
+          matched += digits;
+          hi = toNumber(digits);
        } else {
          // atom{lo,}
          hi = null;
@@ -295,7 +302,11 @@ public class RegExpParser {
        // atom{lo}
        hi = lo;
      }
-      this.expectRBrace();
+      if (!this.match("}")) {
+        // Not a quantifier, just parsing it as a constant. 
+        // E.g. a Regexp such as `/a{|X/`, where there is no matching `}`. 
+        return this.finishTerm(new Sequence(loc, Arrays.asList(atom, new Constant(loc, matched))));
+      }
      return this.finishTerm(new Range(loc, atom, !this.match("?"), lo, hi));
    }
    return atom;
--- a/javascript/extractor/tests/exprs/output/trap/regexp.js.trap
+++ b/javascript/extractor/tests/exprs/output/trap/regexp.js.trap
@@ -1666,13 +1666,10 @@ enclosing_stmt(#20541,#20540)
 enclosing_stmt(#20541,#20540)
 expr_containers(#20541,#20001)
 literals("/a{/","/a{/",#20541)
-#20542=*
+#20542=*
 regexpterm(#20542,1,#20541,0,"a{")
 #20543=@"loc,{#10000},37,2,37,3"
 locations_default(#20543,#10000,37,2,37,3)
-hasLocation(#20542,#20543)
-is_greedy(#20542)
-range_quantifier_lower_bound(#20542,0)
 hasLocation(#20542,#20543)
 #20544=*
 regexpterm(#20544,14,#20542,0,"a")
@@ -1680,379 +1677,370 @@ locations_default(#20545,#10000,37,2,37,2)
 locations_default(#20545,#10000,37,2,37,2)
 hasLocation(#20544,#20545)
 regexp_const_value(#20544,"a")
-#20546=*
-regexp_parse_errors(#20546,#20542,"expected digit")
-#20547=@"loc,{#10000},37,4,37,4"
-locations_default(#20547,#10000,37,4,37,4)
-hasLocation(#20546,#20547)
-#20548=*
-regexp_parse_errors(#20548,#20542,"expected '}'")
-#20549=@"loc,{#10000},37,3,37,3"
-locations_default(#20549,#10000,37,3,37,3)
+#20546=*
+regexpterm(#20546,14,#20542,1,"a{")
+hasLocation(#20546,#20543)
+regexp_const_value(#20546,"{")
+#20547=*
+regexp_parse_errors(#20547,#20542,"expected digit")
+#20548=@"loc,{#10000},37,4,37,4"
+locations_default(#20548,#10000,37,4,37,4)
+hasLocation(#20547,#20548)
+#20549=*
+stmts(#20549,2,#20001,37,"/a{b}/;")
+hasLocation(#20549,#20077)
 stmt_containers(#20549,#20001)
-#20550=*
-stmts(#20550,2,#20001,37,"/a{b}/;")
-hasLocation(#20550,#20077)
+#20550=*
+exprs(#20550,5,#20549,0,"/a{b}/")
+hasLocation(#20550,#20239)
+enclosing_stmt(#20550,#20549)
+expr_containers(#20550,#20001)
 literals("/a{b}/","/a{b}/",#20550)
-#20551=*
-exprs(#20551,5,#20550,0,"/a{b}/")
-hasLocation(#20551,#20239)
-enclosing_stmt(#20551,#20550)
-expr_containers(#20551,#20001)
-literals("/a{b}/","/a{b}/",#20551)
-#20552=*
-regexpterm(#20552,1,#20551,0,"a{b}")
-#20553=@"loc,{#10000},38,2,38,5"
-locations_default(#20553,#10000,38,2,38,5)
-hasLocation(#20552,#20553)
-#20554=*
-regexpterm(#20554,11,#20552,0,"a{")
-#20555=@"loc,{#10000},38,2,38,3"
-locations_default(#20555,#10000,38,2,38,3)
-hasLocation(#20554,#20555)
-is_greedy(#20554)
-range_quantifier_lower_bound(#20554,0)
-range_quantifier_upper_bound(#20554,0)
-#20556=*
-regexpterm(#20556,14,#20554,0,"a")
-#20557=@"loc,{#10000},38,2,38,2"
-locations_default(#20557,#10000,38,2,38,2)
-hasLocation(#20556,#20557)
+#20551=*
+regexpterm(#20551,1,#20550,0,"a{b}")
+#20552=@"loc,{#10000},38,2,38,5"
+locations_default(#20552,#10000,38,2,38,5)
+hasLocation(#20551,#20552)
+#20553=*
+regexpterm(#20553,1,#20551,0,"a{")
+#20554=@"loc,{#10000},38,2,38,3"
+locations_default(#20554,#10000,38,2,38,3)
+hasLocation(#20553,#20554)
+#20555=*
+regexpterm(#20555,14,#20553,0,"a")
+#20556=@"loc,{#10000},38,2,38,2"
+locations_default(#20556,#10000,38,2,38,2)
+hasLocation(#20555,#20556)
+regexp_const_value(#20555,"a")
+#20557=*
+regexpterm(#20557,14,#20553,1,"a{")
+hasLocation(#20557,#20554)
 regexp_const_value(#20557,"{")
-#20558=*
+#20558=*
 regexpterm(#20558,14,#20551,1,"b")
 #20559=@"loc,{#10000},38,4,38,4"
 locations_default(#20559,#10000,38,4,38,4)
 hasLocation(#20558,#20559)
 regexp_const_value(#20558,"b")
-#20560=*
+#20560=*
 regexpterm(#20560,14,#20551,2,"}")
 #20561=@"loc,{#10000},38,5,38,5"
 locations_default(#20561,#10000,38,5,38,5)
 hasLocation(#20560,#20561)
 regexp_const_value(#20560,"}")
-#20562=*
+#20562=*
 regexp_parse_errors(#20562,#20551,"expected digit")
 hasLocation(#20562,#20559)
-#20563=*
-regexp_parse_errors(#20563,#20552,"expected '}'")
-#20564=@"loc,{#10000},38,3,38,3"
-locations_default(#20564,#10000,38,3,38,3)
+#20563=*
+regexp_parse_errors(#20563,#20551,"unexpected character")
+hasLocation(#20563,#20561)
+#20564=*
+stmts(#20564,2,#20001,38,"/a{2/;")
+hasLocation(#20564,#20079)
 stmt_containers(#20564,#20001)
-#20565=*
-regexp_parse_errors(#20565,#20552,"unexpected character")
+#20565=*
+exprs(#20565,5,#20564,0,"/a{2/")
+hasLocation(#20565,#20243)
+enclosing_stmt(#20565,#20564)
+expr_containers(#20565,#20001)
 literals("/a{2/","/a{2/",#20565)
-#20566=*
-stmts(#20566,2,#20001,38,"/a{2/;")
-hasLocation(#20566,#20079)
-stmt_containers(#20566,#20001)
-#20567=*
-exprs(#20567,5,#20566,0,"/a{2/")
-hasLocation(#20567,#20243)
-enclosing_stmt(#20567,#20566)
-expr_containers(#20567,#20001)
+#20566=*
+regexpterm(#20566,1,#20565,0,"a{2")
+#20567=@"loc,{#10000},39,2,39,4"
+locations_default(#20567,#10000,39,2,39,4)
 hasLocation(#20566,#20567)
-#20568=*
-regexpterm(#20568,11,#20567,0,"a{2")
-#20569=@"loc,{#10000},39,2,39,4"
+#20568=*
+regexpterm(#20568,14,#20566,0,"a")
+#20569=@"loc,{#10000},39,2,39,2"
 locations_default(#20569,#10000,39,2,39,2)
-hasLocation(#20568,#20569)
-is_greedy(#20568)
-range_quantifier_lower_bound(#20568,2)
+hasLocation(#20568,#20569)
 regexp_const_value(#20568,"a")
-#20570=*
-regexpterm(#20570,14,#20568,0,"a")
-#20571=@"loc,{#10000},39,2,39,2"
-locations_default(#20571,#10000,39,2,39,2)
-hasLocation(#20570,#20571)
+#20570=*
+regexpterm(#20570,14,#20566,1,"a{2")
+hasLocation(#20570,#20567)
+regexp_const_value(#20570,"{2")
+#20571=*
+stmts(#20571,2,#20001,39,"/\xa/;")
+hasLocation(#20571,#20081)
 stmt_containers(#20571,#20001)
-#20572=*
-regexp_parse_errors(#20572,#20568,"expected '}'")
-#20573=@"loc,{#10000},39,4,39,4"
-locations_default(#20573,#10000,39,4,39,4)
-hasLocation(#20572,#20573)
-#20574=*
-stmts(#20574,2,#20001,39,"/\xa/;")
-hasLocation(#20574,#20081)
-stmt_containers(#20574,#20001)
-#20575=*
-exprs(#20575,5,#20574,0,"/\xa/")
-hasLocation(#20575,#20247)
-enclosing_stmt(#20575,#20574)
-expr_containers(#20575,#20001)
-literals("/\xa/","/\xa/",#20575)
-#20576=*
-regexpterm(#20576,15,#20575,0,"\xa")
-#20577=@"loc,{#10000},40,2,40,4"
-locations_default(#20577,#10000,40,2,40,4)
-hasLocation(#20576,#20577)
+#20572=*
+exprs(#20572,5,#20571,0,"/\xa/")
+hasLocation(#20572,#20247)
+enclosing_stmt(#20572,#20571)
+expr_containers(#20572,#20001)
+literals("/\xa/","/\xa/",#20572)
+#20573=*
+regexpterm(#20573,15,#20572,0,"\xa")
+#20574=@"loc,{#10000},40,2,40,4"
+locations_default(#20574,#10000,40,2,40,4)
+hasLocation(#20573,#20574)
 regexp_const_value(#20573,"
+")
+#20575=*
+regexp_parse_errors(#20575,#20573,"unexpected end of regular expression")
+#20576=@"loc,{#10000},40,5,40,5"
+locations_default(#20576,#10000,40,5,40,5)
+hasLocation(#20575,#20576)
+#20577=*
+stmts(#20577,2,#20001,40,"/\c0/;")
+hasLocation(#20577,#20083)
 stmt_containers(#20577,#20001)
-#20578=*
-regexp_parse_errors(#20578,#20576,"unexpected end of regular expression")
-#20579=@"loc,{#10000},40,5,40,5"
-locations_default(#20579,#10000,40,5,40,5)
-hasLocation(#20578,#20579)
-#20580=*
-stmts(#20580,2,#20001,40,"/\c0/;")
-hasLocation(#20580,#20083)
+#20578=*
+exprs(#20578,5,#20577,0,"/\c0/")
+hasLocation(#20578,#20251)
+enclosing_stmt(#20578,#20577)
+expr_containers(#20578,#20001)
+literals("/\c0/","/\c0/",#20578)
+#20579=*
+regexpterm(#20579,19,#20578,0,"\c0")
+#20580=@"loc,{#10000},41,2,41,4"
+locations_default(#20580,#10000,41,2,41,4)
+hasLocation(#20579,#20580)
 regexp_const_value(#20579,"")
-#20581=*
-exprs(#20581,5,#20580,0,"/\c0/")
-hasLocation(#20581,#20251)
-enclosing_stmt(#20581,#20580)
-expr_containers(#20581,#20001)
-literals("/\c0/","/\c0/",#20581)
-#20582=*
-regexpterm(#20582,19,#20581,0,"\c0")
-#20583=@"loc,{#10000},41,2,41,4"
-locations_default(#20583,#10000,41,2,41,4)
-hasLocation(#20582,#20583)
+#20581=*
+regexp_parse_errors(#20581,#20579,"expected control letter")
+#20582=@"loc,{#10000},41,4,41,4"
+locations_default(#20582,#10000,41,4,41,4)
+hasLocation(#20581,#20582)
+#20583=*
+stmts(#20583,2,#20001,41,"/[]/;")
+hasLocation(#20583,#20085)
 stmt_containers(#20583,#20001)
-#20584=*
-regexp_parse_errors(#20584,#20582,"expected control letter")
-#20585=@"loc,{#10000},41,4,41,4"
-locations_default(#20585,#10000,41,4,41,4)
-hasLocation(#20584,#20585)
-#20586=*
-stmts(#20586,2,#20001,41,"/[]/;")
-hasLocation(#20586,#20085)
+#20584=*
+exprs(#20584,5,#20583,0,"/[]/")
+hasLocation(#20584,#20255)
+enclosing_stmt(#20584,#20583)
+expr_containers(#20584,#20001)
+literals("/[]/","/[]/",#20584)
+#20585=*
+regexpterm(#20585,23,#20584,0,"[]")
+#20586=@"loc,{#10000},42,2,42,3"
+locations_default(#20586,#10000,42,2,42,3)
 hasLocation(#20585,#20586)
-#20587=*
-exprs(#20587,5,#20586,0,"/[]/")
-hasLocation(#20587,#20255)
-enclosing_stmt(#20587,#20586)
-expr_containers(#20587,#20001)
+#20587=*
+stmts(#20587,2,#20001,42,"/[^]/;")
+hasLocation(#20587,#20087)
 stmt_containers(#20587,#20001)
-#20588=*
-regexpterm(#20588,23,#20587,0,"[]")
-#20589=@"loc,{#10000},42,2,42,3"
-locations_default(#20589,#10000,42,2,42,3)
-hasLocation(#20588,#20589)
-#20590=*
-stmts(#20590,2,#20001,42,"/[^]/;")
-hasLocation(#20590,#20087)
+#20588=*
+exprs(#20588,5,#20587,0,"/[^]/")
+hasLocation(#20588,#20259)
+enclosing_stmt(#20588,#20587)
+expr_containers(#20588,#20001)
+literals("/[^]/","/[^]/",#20588)
+#20589=*
+regexpterm(#20589,23,#20588,0,"[^]")
+#20590=@"loc,{#10000},43,2,43,4"
+locations_default(#20590,#10000,43,2,43,4)
+hasLocation(#20589,#20590)
 is_inverted(#20589)
-#20591=*
-exprs(#20591,5,#20590,0,"/[^]/")
-hasLocation(#20591,#20259)
-enclosing_stmt(#20591,#20590)
-expr_containers(#20591,#20001)
+#20591=*
+stmts(#20591,2,#20001,43,"/<tpl\b ... /tpl>/;")
+hasLocation(#20591,#20089)
 stmt_containers(#20591,#20001)
-#20592=*
-regexpterm(#20592,23,#20591,0,"[^]")
-#20593=@"loc,{#10000},43,2,43,4"
-locations_default(#20593,#10000,43,2,43,4)
-hasLocation(#20592,#20593)
-is_inverted(#20592)
-#20594=*
-stmts(#20594,2,#20001,43,"/<tpl\b ... /tpl>/;")
-hasLocation(#20594,#20089)
+#20592=*
+exprs(#20592,5,#20591,0,"/<tpl\b ... \/tpl>/")
+hasLocation(#20592,#20263)
+enclosing_stmt(#20592,#20591)
+expr_containers(#20592,#20001)
+literals("/<tpl\b[^>]*>((?:(?=([^<]+))\2|<(?!tpl\b[^>]*>))*?)<\/tpl>/","/<tpl\b[^>]*>((?:(?=([^<]+))\2|<(?!tpl\b[^>]*>))*?)<\/tpl>/",#20592)
+#20593=*
+regexpterm(#20593,1,#20592,0,"<tpl\b[^>]*>((?:(?=([^<]+))\2|<(?!tpl\b[^>]*>))*?)<\/tpl>")
+#20594=@"loc,{#10000},44,2,44,58"
+locations_default(#20594,#10000,44,2,44,58)
 hasLocation(#20593,#20594)
-#20595=*
-exprs(#20595,5,#20594,0,"/<tpl\b ... \/tpl>/")
-hasLocation(#20595,#20263)
-enclosing_stmt(#20595,#20594)
-expr_containers(#20595,#20001)
-literals("/<tpl\b[^>]*>((?:(?=([^<]+))\2|<(?!tpl\b[^>]*>))*?)<\/tpl>/","/<tpl\b[^>]*>((?:(?=([^<]+))\2|<(?!tpl\b[^>]*>))*?)<\/tpl>/",#20595)
-#20596=*
-regexpterm(#20596,1,#20595,0,"<tpl\b[^>]*>((?:(?=([^<]+))\2|<(?!tpl\b[^>]*>))*?)<\/tpl>")
-#20597=@"loc,{#10000},44,2,44,58"
-locations_default(#20597,#10000,44,2,44,58)
-hasLocation(#20596,#20597)
-#20598=*
-regexpterm(#20598,14,#20596,0,"<tpl")
-#20599=@"loc,{#10000},44,2,44,5"
-locations_default(#20599,#10000,44,2,44,5)
-hasLocation(#20598,#20599)
-regexp_const_value(#20598,"<tpl")
-#20600=*
-regexpterm(#20600,4,#20596,1,"\b")
-#20601=@"loc,{#10000},44,6,44,7"
-locations_default(#20601,#10000,44,6,44,7)
-hasLocation(#20600,#20601)
-#20602=*
-regexpterm(#20602,8,#20596,2,"[^>]*")
-#20603=@"loc,{#10000},44,8,44,12"
-locations_default(#20603,#10000,44,8,44,12)
-hasLocation(#20602,#20603)
-is_greedy(#20602)
-#20604=*
-regexpterm(#20604,23,#20602,0,"[^>]")
-#20605=@"loc,{#10000},44,8,44,11"
-locations_default(#20605,#10000,44,8,44,11)
-hasLocation(#20604,#20605)
-is_inverted(#20604)
-#20606=*
-regexpterm(#20606,14,#20604,0,">")
-#20607=@"loc,{#10000},44,10,44,10"
-locations_default(#20607,#10000,44,10,44,10)
-hasLocation(#20606,#20607)
-regexp_const_value(#20606,">")
-#20608=*
-regexpterm(#20608,14,#20596,3,">")
-#20609=@"loc,{#10000},44,13,44,13"
-locations_default(#20609,#10000,44,13,44,13)
-hasLocation(#20608,#20609)
-regexp_const_value(#20608,">")
-#20610=*
-regexpterm(#20610,13,#20596,4,"((?:(?=([^<]+))\2|<(?!tpl\b[^>]*>))*?)")
-#20611=@"loc,{#10000},44,14,44,51"
-locations_default(#20611,#10000,44,14,44,51)
-hasLocation(#20610,#20611)
-is_capture(#20610,1)
-#20612=*
-regexpterm(#20612,8,#20610,0,"(?:(?=([^<]+))\2|<(?!tpl\b[^>]*>))*?")
-#20613=@"loc,{#10000},44,15,44,50"
-locations_default(#20613,#10000,44,15,44,50)
-hasLocation(#20612,#20613)
-#20614=*
-regexpterm(#20614,13,#20612,0,"(?:(?=([^<]+))\2|<(?!tpl\b[^>]*>))")
-#20615=@"loc,{#10000},44,15,44,48"
-locations_default(#20615,#10000,44,15,44,48)
-hasLocation(#20614,#20615)
-#20616=*
-regexpterm(#20616,0,#20614,0,"(?=([^<]+))\2|<(?!tpl\b[^>]*>)")
-#20617=@"loc,{#10000},44,18,44,47"
-locations_default(#20617,#10000,44,18,44,47)
-hasLocation(#20616,#20617)
-#20618=*
-regexpterm(#20618,1,#20616,0,"(?=([^<]+))\2")
-#20619=@"loc,{#10000},44,18,44,30"
-locations_default(#20619,#10000,44,18,44,30)
-hasLocation(#20618,#20619)
-#20620=*
-regexpterm(#20620,6,#20618,0,"(?=([^<]+))")
-#20621=@"loc,{#10000},44,18,44,28"
-locations_default(#20621,#10000,44,18,44,28)
-hasLocation(#20620,#20621)
-#20622=*
-regexpterm(#20622,13,#20620,0,"([^<]+)")
-#20623=@"loc,{#10000},44,21,44,27"
-locations_default(#20623,#10000,44,21,44,27)
-hasLocation(#20622,#20623)
-is_capture(#20622,2)
-#20624=*
-regexpterm(#20624,9,#20622,0,"[^<]+")
-#20625=@"loc,{#10000},44,22,44,26"
-locations_default(#20625,#10000,44,22,44,26)
-hasLocation(#20624,#20625)
-is_greedy(#20624)
-#20626=*
-regexpterm(#20626,23,#20624,0,"[^<]")
-#20627=@"loc,{#10000},44,22,44,25"
-locations_default(#20627,#10000,44,22,44,25)
-hasLocation(#20626,#20627)
-is_inverted(#20626)
-#20628=*
-regexpterm(#20628,14,#20626,0,"<")
-#20629=@"loc,{#10000},44,24,44,24"
-locations_default(#20629,#10000,44,24,44,24)
-hasLocation(#20628,#20629)
-regexp_const_value(#20628,"<")
-#20630=*
-regexpterm(#20630,22,#20618,1,"\2")
-#20631=@"loc,{#10000},44,29,44,30"
-locations_default(#20631,#10000,44,29,44,30)
-hasLocation(#20630,#20631)
-backref(#20630,2)
-#20632=*
-regexpterm(#20632,1,#20616,1,"<(?!tpl\b[^>]*>)")
-#20633=@"loc,{#10000},44,32,44,47"
-locations_default(#20633,#10000,44,32,44,47)
-hasLocation(#20632,#20633)
-#20634=*
-regexpterm(#20634,14,#20632,0,"<")
-#20635=@"loc,{#10000},44,32,44,32"
-locations_default(#20635,#10000,44,32,44,32)
-hasLocation(#20634,#20635)
-regexp_const_value(#20634,"<")
-#20636=*
-regexpterm(#20636,7,#20632,1,"(?!tpl\b[^>]*>)")
-#20637=@"loc,{#10000},44,33,44,47"
-locations_default(#20637,#10000,44,33,44,47)
-hasLocation(#20636,#20637)
-#20638=*
-regexpterm(#20638,1,#20636,0,"tpl\b[^>]*>")
-#20639=@"loc,{#10000},44,36,44,46"
-locations_default(#20639,#10000,44,36,44,46)
-hasLocation(#20638,#20639)
-#20640=*
-regexpterm(#20640,14,#20638,0,"tpl")
-#20641=@"loc,{#10000},44,36,44,38"
-locations_default(#20641,#10000,44,36,44,38)
-hasLocation(#20640,#20641)
-regexp_const_value(#20640,"tpl")
-#20642=*
-regexpterm(#20642,4,#20638,1,"\b")
-#20643=@"loc,{#10000},44,39,44,40"
-locations_default(#20643,#10000,44,39,44,40)
-hasLocation(#20642,#20643)
-#20644=*
-regexpterm(#20644,8,#20638,2,"[^>]*")
-#20645=@"loc,{#10000},44,41,44,45"
-locations_default(#20645,#10000,44,41,44,45)
-hasLocation(#20644,#20645)
-is_greedy(#20644)
-#20646=*
-regexpterm(#20646,23,#20644,0,"[^>]")
-#20647=@"loc,{#10000},44,41,44,44"
-locations_default(#20647,#10000,44,41,44,44)
-hasLocation(#20646,#20647)
-is_inverted(#20646)
-#20648=*
-regexpterm(#20648,14,#20646,0,">")
-#20649=@"loc,{#10000},44,43,44,43"
-locations_default(#20649,#10000,44,43,44,43)
-hasLocation(#20648,#20649)
-regexp_const_value(#20648,">")
-#20650=*
-regexpterm(#20650,14,#20638,3,">")
-#20651=@"loc,{#10000},44,46,44,46"
-locations_default(#20651,#10000,44,46,44,46)
-hasLocation(#20650,#20651)
-regexp_const_value(#20650,">")
-#20652=*
-regexpterm(#20652,14,#20596,5,"<")
-#20653=@"loc,{#10000},44,52,44,52"
-locations_default(#20653,#10000,44,52,44,52)
-hasLocation(#20652,#20653)
-regexp_const_value(#20652,"<")
-#20654=*
-regexpterm(#20654,21,#20596,6,"\/")
-#20655=@"loc,{#10000},44,53,44,54"
-locations_default(#20655,#10000,44,53,44,54)
-hasLocation(#20654,#20655)
-regexp_const_value(#20654,"/")
-#20656=*
-regexpterm(#20656,14,#20596,7,"tpl>")
-#20657=@"loc,{#10000},44,55,44,58"
-locations_default(#20657,#10000,44,55,44,58)
-hasLocation(#20656,#20657)
-regexp_const_value(#20656,"tpl>")
-#20658=*
-entry_cfg_node(#20658,#20001)
-#20659=@"loc,{#10000},1,1,1,0"
-locations_default(#20659,#10000,1,1,1,0)
-hasLocation(#20658,#20659)
-#20660=*
-exit_cfg_node(#20660,#20001)
-hasLocation(#20660,#20267)
-successor(#20594,#20595)
-successor(#20595,#20660)
-successor(#20590,#20591)
-successor(#20591,#20594)
-successor(#20586,#20587)
-successor(#20587,#20590)
-successor(#20580,#20581)
-successor(#20581,#20586)
-successor(#20574,#20575)
-successor(#20575,#20580)
-successor(#20566,#20567)
-successor(#20567,#20574)
-successor(#20550,#20551)
+#20595=*
+regexpterm(#20595,14,#20593,0,"<tpl")
+#20596=@"loc,{#10000},44,2,44,5"
+locations_default(#20596,#10000,44,2,44,5)
+hasLocation(#20595,#20596)
+regexp_const_value(#20595,"<tpl")
+#20597=*
+regexpterm(#20597,4,#20593,1,"\b")
+#20598=@"loc,{#10000},44,6,44,7"
+locations_default(#20598,#10000,44,6,44,7)
+hasLocation(#20597,#20598)
+#20599=*
+regexpterm(#20599,8,#20593,2,"[^>]*")
+#20600=@"loc,{#10000},44,8,44,12"
+locations_default(#20600,#10000,44,8,44,12)
+hasLocation(#20599,#20600)
+is_greedy(#20599)
+#20601=*
+regexpterm(#20601,23,#20599,0,"[^>]")
+#20602=@"loc,{#10000},44,8,44,11"
+locations_default(#20602,#10000,44,8,44,11)
+hasLocation(#20601,#20602)
+is_inverted(#20601)
+#20603=*
+regexpterm(#20603,14,#20601,0,">")
+#20604=@"loc,{#10000},44,10,44,10"
+locations_default(#20604,#10000,44,10,44,10)
+hasLocation(#20603,#20604)
+regexp_const_value(#20603,">")
+#20605=*
+regexpterm(#20605,14,#20593,3,">")
+#20606=@"loc,{#10000},44,13,44,13"
+locations_default(#20606,#10000,44,13,44,13)
+hasLocation(#20605,#20606)
+regexp_const_value(#20605,">")
+#20607=*
+regexpterm(#20607,13,#20593,4,"((?:(?=([^<]+))\2|<(?!tpl\b[^>]*>))*?)")
+#20608=@"loc,{#10000},44,14,44,51"
+locations_default(#20608,#10000,44,14,44,51)
+hasLocation(#20607,#20608)
+is_capture(#20607,1)
+#20609=*
+regexpterm(#20609,8,#20607,0,"(?:(?=([^<]+))\2|<(?!tpl\b[^>]*>))*?")
+#20610=@"loc,{#10000},44,15,44,50"
+locations_default(#20610,#10000,44,15,44,50)
+hasLocation(#20609,#20610)
+#20611=*
+regexpterm(#20611,13,#20609,0,"(?:(?=([^<]+))\2|<(?!tpl\b[^>]*>))")
+#20612=@"loc,{#10000},44,15,44,48"
+locations_default(#20612,#10000,44,15,44,48)
+hasLocation(#20611,#20612)
+#20613=*
+regexpterm(#20613,0,#20611,0,"(?=([^<]+))\2|<(?!tpl\b[^>]*>)")
+#20614=@"loc,{#10000},44,18,44,47"
+locations_default(#20614,#10000,44,18,44,47)
+hasLocation(#20613,#20614)
+#20615=*
+regexpterm(#20615,1,#20613,0,"(?=([^<]+))\2")
+#20616=@"loc,{#10000},44,18,44,30"
+locations_default(#20616,#10000,44,18,44,30)
+hasLocation(#20615,#20616)
+#20617=*
+regexpterm(#20617,6,#20615,0,"(?=([^<]+))")
+#20618=@"loc,{#10000},44,18,44,28"
+locations_default(#20618,#10000,44,18,44,28)
+hasLocation(#20617,#20618)
+#20619=*
+regexpterm(#20619,13,#20617,0,"([^<]+)")
+#20620=@"loc,{#10000},44,21,44,27"
+locations_default(#20620,#10000,44,21,44,27)
+hasLocation(#20619,#20620)
+is_capture(#20619,2)
+#20621=*
+regexpterm(#20621,9,#20619,0,"[^<]+")
+#20622=@"loc,{#10000},44,22,44,26"
+locations_default(#20622,#10000,44,22,44,26)
+hasLocation(#20621,#20622)
+is_greedy(#20621)
+#20623=*
+regexpterm(#20623,23,#20621,0,"[^<]")
+#20624=@"loc,{#10000},44,22,44,25"
+locations_default(#20624,#10000,44,22,44,25)
+hasLocation(#20623,#20624)
+is_inverted(#20623)
+#20625=*
+regexpterm(#20625,14,#20623,0,"<")
+#20626=@"loc,{#10000},44,24,44,24"
+locations_default(#20626,#10000,44,24,44,24)
+hasLocation(#20625,#20626)
+regexp_const_value(#20625,"<")
+#20627=*
+regexpterm(#20627,22,#20615,1,"\2")
+#20628=@"loc,{#10000},44,29,44,30"
+locations_default(#20628,#10000,44,29,44,30)
+hasLocation(#20627,#20628)
+backref(#20627,2)
+#20629=*
+regexpterm(#20629,1,#20613,1,"<(?!tpl\b[^>]*>)")
+#20630=@"loc,{#10000},44,32,44,47"
+locations_default(#20630,#10000,44,32,44,47)
+hasLocation(#20629,#20630)
+#20631=*
+regexpterm(#20631,14,#20629,0,"<")
+#20632=@"loc,{#10000},44,32,44,32"
+locations_default(#20632,#10000,44,32,44,32)
+hasLocation(#20631,#20632)
+regexp_const_value(#20631,"<")
+#20633=*
+regexpterm(#20633,7,#20629,1,"(?!tpl\b[^>]*>)")
+#20634=@"loc,{#10000},44,33,44,47"
+locations_default(#20634,#10000,44,33,44,47)
+hasLocation(#20633,#20634)
+#20635=*
+regexpterm(#20635,1,#20633,0,"tpl\b[^>]*>")
+#20636=@"loc,{#10000},44,36,44,46"
+locations_default(#20636,#10000,44,36,44,46)
+hasLocation(#20635,#20636)
+#20637=*
+regexpterm(#20637,14,#20635,0,"tpl")
+#20638=@"loc,{#10000},44,36,44,38"
+locations_default(#20638,#10000,44,36,44,38)
+hasLocation(#20637,#20638)
+regexp_const_value(#20637,"tpl")
+#20639=*
+regexpterm(#20639,4,#20635,1,"\b")
+#20640=@"loc,{#10000},44,39,44,40"
+locations_default(#20640,#10000,44,39,44,40)
+hasLocation(#20639,#20640)
+#20641=*
+regexpterm(#20641,8,#20635,2,"[^>]*")
+#20642=@"loc,{#10000},44,41,44,45"
+locations_default(#20642,#10000,44,41,44,45)
+hasLocation(#20641,#20642)
+is_greedy(#20641)
+#20643=*
+regexpterm(#20643,23,#20641,0,"[^>]")
+#20644=@"loc,{#10000},44,41,44,44"
+locations_default(#20644,#10000,44,41,44,44)
+hasLocation(#20643,#20644)
+is_inverted(#20643)
+#20645=*
+regexpterm(#20645,14,#20643,0,">")
+#20646=@"loc,{#10000},44,43,44,43"
+locations_default(#20646,#10000,44,43,44,43)
+hasLocation(#20645,#20646)
+regexp_const_value(#20645,">")
+#20647=*
+regexpterm(#20647,14,#20635,3,">")
+#20648=@"loc,{#10000},44,46,44,46"
+locations_default(#20648,#10000,44,46,44,46)
+hasLocation(#20647,#20648)
+regexp_const_value(#20647,">")
+#20649=*
+regexpterm(#20649,14,#20593,5,"<")
+#20650=@"loc,{#10000},44,52,44,52"
+locations_default(#20650,#10000,44,52,44,52)
+hasLocation(#20649,#20650)
+regexp_const_value(#20649,"<")
+#20651=*
+regexpterm(#20651,21,#20593,6,"\/")
+#20652=@"loc,{#10000},44,53,44,54"
+locations_default(#20652,#10000,44,53,44,54)
+hasLocation(#20651,#20652)
+regexp_const_value(#20651,"/")
+#20653=*
+regexpterm(#20653,14,#20593,7,"tpl>")
+#20654=@"loc,{#10000},44,55,44,58"
+locations_default(#20654,#10000,44,55,44,58)
+hasLocation(#20653,#20654)
+regexp_const_value(#20653,"tpl>")
+#20655=*
+entry_cfg_node(#20655,#20001)
+#20656=@"loc,{#10000},1,1,1,0"
+locations_default(#20656,#10000,1,1,1,0)
+hasLocation(#20655,#20656)
+#20657=*
+exit_cfg_node(#20657,#20001)
+hasLocation(#20657,#20267)
+successor(#20591,#20592)
+successor(#20592,#20657)
+successor(#20587,#20588)
+successor(#20588,#20591)
+successor(#20583,#20584)
+successor(#20584,#20587)
+successor(#20577,#20578)
+successor(#20578,#20583)
+successor(#20571,#20572)
+successor(#20572,#20577)
+successor(#20564,#20565)
+successor(#20565,#20571)
+successor(#20549,#20550)
 successor(#20550,#20564)
-successor(#20540,#20541)
+successor(#20540,#20541)
 successor(#20541,#20549)
 successor(#20530,#20531)
 successor(#20531,#20540)
@@ -2125,6 +2113,6 @@ successor(#20273,#20274)
 successor(#20273,#20274)
 successor(#20274,#20281)
 successor(#20269,#20270)
-successor(#20270,#20273)
+successor(#20270,#20273)
 successor(#20655,#20269)
 numlines(#10000,44,44,0)
--- a/javascript/ql/test/query-tests/Performance/ReDoS/ReDoS.expected
+++ b/javascript/ql/test/query-tests/Performance/ReDoS/ReDoS.expected
@@ -168,3 +168,7 @@
 | tst.js:351:15:351:16 | a+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'a'. |
 | tst.js:352:15:352:16 | a* | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'a'. |
 | tst.js:353:15:353:16 | a+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'a'. |
+| tst.js:360:15:360:30 | ((?:a{\|-)\|\\w\\{)+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'a{'. |
+| tst.js:361:15:361:33 | ((?:a{0\|-)\|\\w\\{\\d)+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'a{0'. |
+| tst.js:362:15:362:35 | ((?:a{0,\|-)\|\\w\\{\\d,)+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'a{0,'. |
+| tst.js:363:15:363:38 | ((?:a{0,2\|-)\|\\w\\{\\d,\\d)+ | This part of the regular expression may cause exponential backtracking on strings containing many repetitions of 'a{0,2'. |
--- a/javascript/ql/test/query-tests/Performance/ReDoS/tst.js
+++ b/javascript/ql/test/query-tests/Performance/ReDoS/tst.js
@@ -355,3 +355,12 @@ var bad82 = /(a+)+b/;
 // GOOD
 var good40 = /(a|b)+/;
 var good41 = /(?:[\s;,"'<>(){}|[\]@=+*]|:(?![/\\]))+/;
+
+// NOT GOOD
+var bad83 = /^((?:a{|-)|\w\{)+X$/; 
+var bad84 = /^((?:a{0|-)|\w\{\d)+X$/; 
+var bad85 = /^((?:a{0,|-)|\w\{\d,)+X$/; 
+var bad86 = /^((?:a{0,2|-)|\w\{\d,\d)+X$/; 
+
+// GOOD: 
+var good42 = /^((?:a{0,2}|-)|\w\{\d,\d\})+X$/; 
--- a/javascript/ql/test/query-tests/RegExp/MalformedRegExp/MalformedRegExp.expected
+++ b/javascript/ql/test/query-tests/RegExp/MalformedRegExp/MalformedRegExp.expected
@@ -1,3 +1,2 @@
-| tst.js:1:4:1:4 | expected '}' | Malformed regular expression: expected '}'. |
 | tst.js:4:29:4:29 | unexpected character | Malformed regular expression: unexpected character. |
 | tst.js:4:43:4:43 | unexpected character | Malformed regular expression: unexpected character. |
--- a/javascript/ql/test/query-tests/RegExp/MalformedRegExp/tst.js
+++ b/javascript/ql/test/query-tests/RegExp/MalformedRegExp/tst.js
@@ -1,4 +1,4 @@
-/a{1/;
+/a{1/; // OK

 function f() {
  return a.replace(/<\!--(?!{cke_protected})[\s\S]+?--\>/g, "foo");
--- a/javascript/ql/test/query-tests/RegExp/RegExpAlwaysMatches/tst.js
+++ b/javascript/ql/test/query-tests/RegExp/RegExpAlwaysMatches/tst.js
@@ -85,3 +85,8 @@ function nonWordBoundary(x) {
 function emptyRegex(x) {
  return new RegExp("").test(x); // NOT OK
 }
+
+function parserTest(x) {
+  /(\w\s*:\s*[^:}]+|#){|@import[^\n]+(?:url|,)/.test(x); // OK
+  /^((?:a{0,2}|-)|\w\{\d,\d\})+X$/.text(x); // ok 
+}