gina 0.6.32 → 0.6.33

package/framework/{v0.6.32 → v0.6.33}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -3064,6 +3064,142 @@ function ownCount(container) {
     return Object.prototype.count.call(container);
 }
 
+/**
+ * Escapes a value for use INSIDE a JSON string literal: `"`, `\` and the control
+ * characters U+0000 to U+001F, exactly what JSON requires and nothing else, so a value
+ * carrying none of them comes back unchanged (#B600). A lone surrogate is left as it is
+ * on purpose: it never broke a parse, so escaping it would only change bytes. The
+ * validator plugin's `main.js` carries the same function for its rule-set splices.
+ *
+ * @param   {*} value - Coerced with `String()`.
+ * @returns {string} The escaped text, without surrounding quotes.
+ * @inner
+ *
+ * @example
+ * escapeForJsonString('say "hi"'); // the text: say \"hi\"
+ */
+function escapeForJsonString(value) {
+    return String(value).replace(/[\u0000-\u001f"\\]/g, function (ch) {
+        switch (ch) {
+            case '"'  : return '\\"';
+            case '\\' : return '\\\\';
+            case '\b' : return '\\b';
+            case '\f' : return '\\f';
+            case '\n' : return '\\n';
+            case '\r' : return '\\r';
+            case '\t' : return '\\t';
+            default   : return '\\u' + ('000' + ch.charCodeAt(0).toString(16)).slice(-4);
+        }
+    });
+}
+
+/**
+ * Restores the field values spliced into a `query` rule's request body (#B600).
+ *
+ * Every spliced value arrives wrapped in quotes and escaped as a JSON string literal;
+ * each one is decoded back to the value, and any other quote character is dropped, as
+ * the body always had them dropped. The old cleanup deleted every escaped quote from
+ * the JSON text, which was only right for values with no `"` or `\`: a quote in a
+ * value came out as a backslash, and a value ending in a backslash broke the body.
+ *
+ * Works token by token on the JSON text, so key order and every non-string token stay
+ * byte-identical; for a body whose strings carry no backslash the output is exactly
+ * what the old cleanup produced. An authored quoted segment that is valid JSON is
+ * decoded too, the one place the two ever differ.
+ *
+ * @param   {string} jsonText - The request body, as JSON text.
+ * @returns {string} The body with every spliced value restored, as JSON text.
+ * @inner
+ *
+ * @example
+ * // a spliced `jo"hn` sits in the body as the literal "jo\"hn"
+ * decodeSplicedQuotes(JSON.stringify({ account: '"jo\\"hn"' }));
+ * // the text: {"account":"jo\"hn"}, which the server reads as jo"hn
+ */
+function decodeSplicedQuotes(jsonText) {
+    return jsonText.replace(/"(?:[^"\\]|\\.)*"/g, function (token) {
+        var text = null;
+        try {
+            text = JSON.parse(token);
+        } catch (tokenErr) {
+            return token.replace(/\\"/g, '');
+        }
+        return JSON.stringify(text.replace(/"(?:[^"\\]|\\.)*"|"/g, function (segment) {
+            if (segment === '"') {
+                return '';
+            }
+            try {
+                return JSON.parse(segment);
+            } catch (segmentErr) {
+                return segment.replace(/"/g, '');
+            }
+        }));
+    });
+}
+
+/**
+ * escapeRegExp
+ * Escapes every RegExp metacharacter of `text`, so a field name matches
+ * itself inside a pattern built from it.
+ *
+ * @param {string} text - a field name
+ * @returns {string} the escaped text
+ *
+ * @example
+ * new RegExp('\\$' + escapeRegExp('pw[0]')).test('$pw[0]'); // true — `[0]` is not a character class
+ */
+function escapeRegExp(text) {
+    return String(text).replace(/[.*+?^${}()|[\]\\\/-]/g, '\\$&');
+}
+
+/**
+ * substituteFieldTokens
+ * Resolves every `$<field>` token of `text` in ONE pass — the one grammar
+ * shared by `is()` conditions, the client `query` body and the plugin's
+ * dynamised rule set (#B603 / #B604 / #B606).
+ *
+ * A token is `$` immediately followed by one of `names`. The longest matching
+ * name wins whatever order the names were listed in, so `$password-confirm`
+ * is never read as `$password` + `-confirm`; a token ends where its name ends
+ * provided the next character is not a name character (`[A-Za-z0-9_-]`), so
+ * `($a)`, `$a===$b` and `$a,` resolve while `$passwordX` leaves `password`
+ * alone. Names are matched case-sensitively and RegExp-escaped. Whatever
+ * `resolve` returns is spliced verbatim and never scanned again, so a value
+ * that itself contains `$other` stays as typed. A `$` that names none of
+ * `names` is not a token and is left literal.
+ *
+ * @param {string} text - the text carrying the tokens
+ * @param {string[]} names - the field names in scope (duplicates and empty names are ignored)
+ * @param {function(string, string): string} resolve - `(name, token)` -> the replacement text
+ * @returns {string} `text` with every token replaced
+ *
+ * @example
+ * substituteFieldTokens('($a) === ($a-confirm)', ['a', 'a-confirm'], function(name) {
+ *     return JSON.stringify(values[name]);
+ * });
+ * // -> ("x$a") === ("x$a")   — the `$a` inside the value is not resolved again
+ */
+function substituteFieldTokens(text, names, resolve) {
+    var list = [], i = 0, name = null;
+    for (; i < names.length; i++) {
+        name = String(names[i]);
+        if ( name !== '' && list.indexOf(name) < 0 ) {
+            list.push(name);
+        }
+    }
+    if ( !list.length ) {
+        return text;
+    }
+    // longest first: a longer name always wins over a name it starts with
+    list.sort(function(a, b) {
+        return b.length - a.length || ( (a < b) ? -1 : ( (a > b) ? 1 : 0 ) );
+    });
+    var re = new RegExp('\\$(' + list.map(escapeRegExp).join('|') + ')(?![A-Za-z0-9_-])', 'g');
+    return String(text).replace(re, function(token, matched) {
+        return resolve(matched, token);
+    });
+}
+
 function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
 
     var isGFFCtx        = ( ( typeof(module) !== 'undefined' ) && module.exports ) ? false : true;
@@ -3675,22 +3811,41 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
         // replace placeholders by field values
         strData = JSON.stringify(queryData);
         if ( /\$/.test(strData) ) {
-            var variables = strData.match(/\$[-_\[\]a-z 0-9]+/g) || [];
-            var value = null, key = null;
-            for (let i = 0, len = variables.length; i < len; i++) {
-                key = variables[i].replace(/\$/g, '');
-                re = new RegExp("\\"+ variables[i].replace(/\[|\]/g, '\\$&'), "g");
-                value = local.data[key] || null;
+            // #B606 — one pass through the shared tokenizer: the scan
+            // `/\$[-_\[\]a-z 0-9]+/g` was lowercase-only (`$passwordConfirm` resolved
+            // `$password` + `Confirm` — another field's value on the wire), read a space as
+            // part of the token, and each name re-scanned the body after every splice
+            // (`$password` ate `$password-confirm` in body order; a spliced `x$b` was hit
+            // again). The token universe is the engine's fields plus, under live-check,
+            // every control of the form (a sibling not yet validated resolves from the
+            // live element, as before); a `$` naming none of them is text and stays as
+            // typed — it used to go out as the string `null`, and threw under live-check.
+            var tokenNames = Object.keys(local.data);
+            if (isInlineValidation) {
+                for (let f in fieldsSet) {
+                    if (fieldsSet[f].name) {
+                        tokenNames.push(fieldsSet[f].name);
+                    }
+                }
+            }
+            var _queryForm = this.target.form;
+            strData = substituteFieldTokens(strData, tokenNames, function(key) {
+                var value = local.data[key] || null;
                 if (!value && isInlineValidation) {
                     // Retrieving live value instead of using fieldsSet.value
-                    value = getElementByName(this.target.form, key).value;
+                    value = getElementByName(_queryForm, key).value;
                 }
-
-                strData = strData.replace( re, value );
-            }
+                // #B600 — spliced as a quoted string operand escaped twice, the form every
+                // other spliced value takes, so decodeSplicedQuotes() below restores it
+                // exactly; through a function replacer, so a `$&` in it stays text. It went
+                // in verbatim, which corrupted the body for a value carrying a `"` or `\`.
+                return '\\"' + escapeForJsonString(escapeForJsonString(value)) + '\\"';
+            });
         }
         // cleanup before sending
-        queryData = strData.replace(/\\"/g, '');
+        // #B600 — each spliced value is decoded back, instead of every escaped quote being
+        // deleted from the JSON text (which turned a `"` in a value into a backslash).
+        queryData = decodeSplicedQuotes(strData);
         // TODO - support regexp for validIf
         var validIf = ( typeof(options.validIf) == 'undefined' ) ? true : options.validIf;
 
@@ -4383,6 +4538,10 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
          *       "/^[0-9]+$/"   -> only numbers
          *       "$field === $fieldOther"   -> will be evaluated
          *
+         *  A `$<field>` token follows `substituteFieldTokens`: the longest field name
+         *  wins, a token ends at any character outside [A-Za-z0-9_-] (so `($field)`
+         *  and `$field===$other` resolve), and a `$` naming no field stays literal.
+         *
          * @param {object|string} condition - RegExp object, or condition to eval, or eval result
          * @param {string} [errorMessage] - error message
          * @param {string} [errorStack] - error stack
@@ -4428,94 +4587,149 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
                 var re = null, flags = null;
                 // Fixed added on 2021-03-13: $variable now replaced with real value beafore validation
                 if ( /[\!\=>\>\<a-z 0-9]+/i.test(condition) ) {
-                    var variables = condition.match(/\${0}[-_,.\[\]a-z0-9]+/ig); // without space(s)
-                    if (variables && variables.length > 0) {
-                        var compiledCondition = condition;
-                        for (var i = 0, len = variables.length; i < len; ++i) {
-                            // $varibale comparison
-                            if ( typeof(self[ variables[i] ]) != 'undefined' && variables[i]) {
-                                re = new RegExp("\\$"+ variables[i] +"(?!\\S+)", "g");
-                                if ( self[ variables[i] ].value == "" ) {
-                                    compiledCondition = compiledCondition.replace(re, '""');
-                                } else if ( typeof(self[ variables[i] ].value) == 'string' ) {
-                                    compiledCondition = compiledCondition.replace(re, '"'+ self[ variables[i] ].value +'"');
-                                } else {
-                                    compiledCondition = compiledCondition.replace(re, self[ variables[i] ].value);
-                                }
-                            }
+                    // #B602 — a condition with nothing to substitute is still evaluated: the
+                    // evaluation below used to run only when a scan found an ASCII letter or digit
+                    // run, so a comparison of values made only of symbols or non-ASCII letters
+                    // (`!!!`, `é€`) never reached the grammar and always read as a mismatch.
+                    // #B604 — one pass through the shared tokenizer (longest name first, a token
+                    // ends at any non-name character, names RegExp-escaped): the per-name
+                    // `"\$" + name + "(?!\S+)"` replace resolved a token only when whitespace or
+                    // the end followed it, so `($a) === ($b)` and `$a===$b` never resolved, and a
+                    // bracket name became a character class. The token universe is the instance's
+                    // FIELDS (an own object carrying `value`): an engine method name is not a token
+                    // and stays literal for the grammar to refuse — it used to splice `undefined`.
+                    var fieldNames = [];
+                    for (var fieldKey in self) {
+                        if ( self.hasOwnProperty(fieldKey) && self[fieldKey] && typeof(self[fieldKey]) == 'object' && ('value' in self[fieldKey]) ) {
+                            fieldNames.push(fieldKey);
+                        }
+                    }
+                    var resolveFieldToken = function(name) {
+                        var value = self[name].value;
+                        if ( value == "" ) {
+                            return '""';
                         }
+                        if ( typeof(value) == 'string' ) {
+                            // #B600 — a JSON string literal: a `"` in the value cannot break the
+                            // operand, and the function replacer keeps a `$&` in it as text.
+                            return JSON.stringify(value);
+                        }
+                        return value;
+                    };
+                    // Tokens are resolved OUTSIDE string literals only, and never inside a
+                    // regex literal (compiled exactly as authored, #B345): the plugin path
+                    // arrives here with every value already spliced as a literal, so a value
+                    // holding `$other` must not be resolved a second time (#B603).
+                    // `_SCS_SEGMENT_RE` splits a condition into string literals and the code
+                    // between them; the #B601 strip below walks the same segments.
+                    var _SCS_SEGMENT_RE = /"(?:[^"\\]|\\.)*"|[^"]+/g;
+                    var compiledCondition = condition;
+                    if ( !/^\//.test(condition) ) {
+                        compiledCondition = condition.replace(_SCS_SEGMENT_RE, function(part) {
+                            return ( part.charAt(0) === '"' ) ? part : substituteFieldTokens(part, fieldNames, resolveFieldToken);
+                        });
+                    }
 
-                        try {
-                            // #SCS1e (2026-04-24) — replaced the two `eval(...)` calls below with
-                            // auditable equivalents. After `$var` substitution (lines 910-920),
-                            // `compiledCondition` is either:
-                            //   (a) a regex literal `/<body>/<flags>` (when `/^\//` matches), or
-                            //   (b) a binary comparison `<operand><op><operand>` where operand ∈
-                            //       {number, "string", true, false, null, undefined} and op ∈
-                            //       {===, !==, ==, !=, <, >, <=, >=} — paren/`return`-stripped
-                            //       inside its branch, before the grammar match.
-                            // Old eval executed arbitrary JS; any value reaching `$var` substitution
-                            // that contained a quote (e.g. user input `bar"; process.exit();//`)
-                            // could escape the `"..."` wrapper at line 916 and reach eval as
-                            // arbitrary code. Grammar-locked replacements reject any input that
-                            // doesn't fit the two documented shapes.
-                            // if ( /^\//.test(compiledCondition) ) {
-                            //     isValid = eval(compiledCondition + '.test("' + this.value + '")')
-                            // } else {
-                            //     isValid = eval(compiledCondition)
-                            // }
-                            // #B345 — the paren/`return` strip used to run HERE, before the branch
-                            // decision, so it also mangled every parenthesized regex literal:
-                            // groups were destroyed (`^(a|b)$` compiled as `^a|b$`, rebinding the
-                            // anchors and turning middle alternatives substring-permissive),
-                            // quantified groups were requantified (`(#TAG)?` became `#TA` plus an
-                            // optional `G`), and a literal `return` inside a pattern was deleted —
-                            // all silently, because the stripped text still compiled as a valid
-                            // regex. The strip protects the BINARY-COMPARISON shape only, so it
-                            // now lives inside that branch; the regex branch never evaluates the
-                            // condition as JS (`new RegExp(body, flags).test(value)` — no eval),
-                            // so parentheses there are legitimate syntax and a regex literal is
-                            // compiled exactly as authored.
-                            if ( /^\//.test(compiledCondition) ) {
-                                var _scsRegexMatch = compiledCondition.match(/^\/(.+)\/([a-z]*)$/);
-                                if (!_scsRegexMatch) {
-                                    throw new Error('Invalid regex literal: `' + compiledCondition + '`');
-                                }
-                                isValid = new RegExp(_scsRegexMatch[1], _scsRegexMatch[2]).test(this.value);
+                    try {
+                        // #SCS1e (2026-04-24) — replaced the two `eval(...)` calls below with
+                        // auditable equivalents. After `$var` substitution (lines 910-920),
+                        // `compiledCondition` is either:
+                        //   (a) a regex literal `/<body>/<flags>` (when `/^\//` matches), or
+                        //   (b) a binary comparison `<operand><op><operand>` where operand ∈
+                        //       {number, "string", true, false, null, undefined} and op ∈
+                        //       {===, !==, ==, !=, <, >, <=, >=} — paren/`return`-stripped
+                        //       inside its branch, before the grammar match.
+                        // Old eval executed arbitrary JS; any value reaching `$var` substitution
+                        // that contained a quote (e.g. user input `bar"; process.exit();//`)
+                        // could escape the `"..."` wrapper at line 916 and reach eval as
+                        // arbitrary code. Grammar-locked replacements reject any input that
+                        // doesn't fit the two documented shapes.
+                        // if ( /^\//.test(compiledCondition) ) {
+                        //     isValid = eval(compiledCondition + '.test("' + this.value + '")')
+                        // } else {
+                        //     isValid = eval(compiledCondition)
+                        // }
+                        // #B345 — the paren/`return` strip used to run HERE, before the branch
+                        // decision, so it also mangled every parenthesized regex literal:
+                        // groups were destroyed (`^(a|b)$` compiled as `^a|b$`, rebinding the
+                        // anchors and turning middle alternatives substring-permissive),
+                        // quantified groups were requantified (`(#TAG)?` became `#TA` plus an
+                        // optional `G`), and a literal `return` inside a pattern was deleted —
+                        // all silently, because the stripped text still compiled as a valid
+                        // regex. The strip protects the BINARY-COMPARISON shape only, so it
+                        // now lives inside that branch; the regex branch never evaluates the
+                        // condition as JS (`new RegExp(body, flags).test(value)` — no eval),
+                        // so parentheses there are legitimate syntax and a regex literal is
+                        // compiled exactly as authored.
+                        if ( /^\//.test(compiledCondition) ) {
+                            var _scsRegexMatch = compiledCondition.match(/^\/(.+)\/([a-z]*)$/);
+                            if (!_scsRegexMatch) {
+                                throw new Error('Invalid regex literal: `' + compiledCondition + '`');
+                            }
+                            isValid = new RegExp(_scsRegexMatch[1], _scsRegexMatch[2]).test(this.value);
+                        } else {
+                            // security checks (#SCS1e) — strip parens/`return` before the
+                            // grammar-locked match; authored parens in a comparison stay
+                            // tolerated (`("a") === ("a")` strips to `"a" === "a"`).
+                            // #B601 — only OUTSIDE string literals: the strip ran over the compared
+                            // values too, so two values differing only by a parenthesis or the word
+                            // `return` compared as equal.
+                            compiledCondition = compiledCondition.replace(_SCS_SEGMENT_RE, function(_scsPart) {
+                                return ( _scsPart.charAt(0) === '"' ) ? _scsPart : _scsPart.replace(/(\(|\)|return)/g, '');
+                            });
+                            // #B600 — a string operand may carry escaped quotes and backslashes
+                            var _SCS_BINARY_RE = /^\s*(null|undefined|true|false|"(?:[^"\\]|\\.)*"|-?\d+(?:\.\d+)?)\s*(===|!==|<=|>=|==|!=|<|>)\s*(null|undefined|true|false|"(?:[^"\\]|\\.)*"|-?\d+(?:\.\d+)?)\s*$/;
+                            var _scsBinMatch = (typeof(compiledCondition) == 'string') ? compiledCondition.match(_SCS_BINARY_RE) : null;
+                            if (!_scsBinMatch) {
+                                // A condition that doesn't fit the grammar (e.g. a dangling
+                                // operator left by an empty cross-field reference) must FAIL
+                                // THE FIELD, not throw: is() runs on every keystroke during
+                                // live-check, and an uncaught throw propagates out of the
+                                // whole-form validity pass (main.js checkFieldAgainstRules
+                                // re-wraps + re-throws it), leaving the submit trigger ungated.
+                                // A genuine authoring typo stays visible via the warning
+                                // without killing live validation. Fail-closed: the field is
+                                // treated as invalid on both the client and the server.
+                                console.warn('[FormValidator] Could not evaluate condition `' + compiledCondition + '` - treating field as invalid.\n(grammar: <operand><op><operand>; operand ∈ number | "string" | true | false | null | undefined; op ∈ === !== == != < > <= >=)');
+                                isValid = false;
                             } else {
-                                // security checks (#SCS1e) — strip parens/`return` before the
-                                // grammar-locked match; authored parens in a comparison stay
-                                // tolerated (`("a") === ("a")` strips to `"a" === "a"`).
-                                compiledCondition = compiledCondition.replace(/(\(|\)|return)/g, '');
-                                var _SCS_BINARY_RE = /^\s*(null|undefined|true|false|"[^"]*"|-?\d+(?:\.\d+)?)\s*(===|!==|<=|>=|==|!=|<|>)\s*(null|undefined|true|false|"[^"]*"|-?\d+(?:\.\d+)?)\s*$/;
-                                var _scsBinMatch = (typeof(compiledCondition) == 'string') ? compiledCondition.match(_SCS_BINARY_RE) : null;
-                                if (!_scsBinMatch) {
-                                    // A condition that doesn't fit the grammar (e.g. a dangling
-                                    // operator left by an empty cross-field reference) must FAIL
-                                    // THE FIELD, not throw: is() runs on every keystroke during
-                                    // live-check, and an uncaught throw propagates out of the
-                                    // whole-form validity pass (main.js checkFieldAgainstRules
-                                    // re-wraps + re-throws it), leaving the submit trigger ungated.
-                                    // A genuine authoring typo stays visible via the warning
-                                    // without killing live validation. Fail-closed: the field is
-                                    // treated as invalid on both the client and the server.
-                                    console.warn('[FormValidator] Could not evaluate condition `' + compiledCondition + '` - treating field as invalid.\n(grammar: <operand><op><operand>; operand ∈ number | "string" | true | false | null | undefined; op ∈ === !== == != < > <= >=)');
+                                var _scsParseOperand = function(s) {
+                                    var _t = s.replace(/^\s+|\s+$/g, '');
+                                    if (_t === 'null')      return null;
+                                    if (_t === 'undefined') return undefined;
+                                    if (_t === 'true')      return true;
+                                    if (_t === 'false')     return false;
+                                    // #B600 — a string operand is decoded as the JSON string literal the
+                                    // splice made it (every `"`, `\` and control character escaped). An
+                                    // authored literal that is not valid JSON (`"C:\dir"`) is read verbatim
+                                    // between its quotes, as every string operand was before.
+                                    if (/^"(?:[^"\\]|\\.)*"$/.test(_t)) {
+                                        try {
+                                            return JSON.parse(_t);
+                                        } catch (_scsLiteralErr) {
+                                            if (/^"[^"]*"$/.test(_t)) return _t.slice(1, -1);
+                                            throw _scsLiteralErr;
+                                        }
+                                    }
+                                    var _n = Number(_t);
+                                    if (!isNaN(_n) && _t !== '') return _n;
+                                    throw new Error('Invalid operand: `' + s + '`');
+                                };
+                                var _scsLeft = null, _scsRight = null, _scsOperandErr = null;
+                                try {
+                                    _scsLeft  = _scsParseOperand(_scsBinMatch[1]);
+                                    _scsRight = _scsParseOperand(_scsBinMatch[3]);
+                                } catch (_scsErr) {
+                                    _scsOperandErr = _scsErr;
+                                }
+                                if (_scsOperandErr) {
+                                    // #B600 — an operand that cannot be read fails the FIELD, like a
+                                    // grammar mismatch: a throw here would leave through the catch
+                                    // below and abort the whole validity pass.
+                                    console.warn('[FormValidator] Could not read an operand of `' + compiledCondition + '` - treating field as invalid.\n(' + _scsOperandErr.message + ')');
                                     isValid = false;
                                 } else {
-                                    var _scsParseOperand = function(s) {
-                                        var _t = s.replace(/^\s+|\s+$/g, '');
-                                        if (_t === 'null')      return null;
-                                        if (_t === 'undefined') return undefined;
-                                        if (_t === 'true')      return true;
-                                        if (_t === 'false')     return false;
-                                        if (/^"[^"]*"$/.test(_t)) return _t.slice(1, -1);
-                                        var _n = Number(_t);
-                                        if (!isNaN(_n) && _t !== '') return _n;
-                                        throw new Error('Invalid operand: `' + s + '`');
-                                    };
-                                    var _scsLeft  = _scsParseOperand(_scsBinMatch[1]);
-                                    var _scsOp    = _scsBinMatch[2];
-                                    var _scsRight = _scsParseOperand(_scsBinMatch[3]);
+                                    var _scsOp = _scsBinMatch[2];
                                     switch (_scsOp) {
                                         case '===': isValid = _scsLeft === _scsRight; break;
                                         case '!==': isValid = _scsLeft !== _scsRight; break;
@@ -4528,10 +4742,10 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
                                     }
                                 }
                             }
-
-                        } catch (err) {
-                            throw new Error(err.stack||err.message)
                         }
+
+                    } catch (err) {
+                        throw new Error(err.stack||err.message)
                     }
                 } else if ( condition instanceof RegExp ) {
 
@@ -6082,6 +6296,13 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
     return self
 };
 
+/**
+ * The one `$`-token grammar, exposed for the validator plugin's dynamised rule
+ * set — see `substituteFieldTokens`.
+ * @type {function(string, string[], function(string, string): string): string}
+ */
+FormValidatorUtil.substituteFieldTokens = substituteFieldTokens;
+
 if ( ( typeof(module) !== 'undefined' ) && module.exports ) {
     // Publish as node.js module
     module.exports  = FormValidatorUtil
@@ -6134,6 +6355,28 @@ function Routing() {
     // When exceeded, the oldest entry (insertion order) is evicted first.
     var MAX_CACHED_ROUTES = 5000;
 
+    /**
+     * Own-property test for a lookup keyed by a name the client may choose (#B650). A plain
+     * `obj[key]` read also resolves `Object.prototype` members, so a query key named
+     * `toString` or `valueOf` read as a requirement the rule declares.
+     *
+     * `Object.prototype.hasOwnProperty.call`, not `Object.hasOwn`: this file is also bundled
+     * for the browser.
+     *
+     * @inner
+     * @private
+     * @param {object} obj - the object to test (a rule's `requirements` or `param`)
+     * @param {string} key - the key to look for
+     * @returns {boolean} true when `obj` itself carries `key`
+     *
+     * @example
+     * hasOwn({ id: '/^[0-9]+$/' }, 'id');       // => true
+     * hasOwn({ id: '/^[0-9]+$/' }, 'toString'); // => false
+     */
+    var hasOwn = function(obj, key) {
+        return obj !== null && typeof(obj) != 'undefined' && Object.prototype.hasOwnProperty.call(obj, key);
+    };
+
 
     self.allowedMethodsString   = self.allowedMethods.join(',');
 
@@ -6492,7 +6735,9 @@ function Routing() {
                         continue;
                     }
                     let _key = uRo[p].substring(1);
-                    if ( typeof(params.requirements[_key]) == 'undefined' ) {
+                    // #B650 — a requirement counts only when the rule declares it itself.
+                    // was: if ( typeof(params.requirements[_key]) == 'undefined' ) {
+                    if ( !hasOwn(params.requirements, _key) || typeof(params.requirements[_key]) == 'undefined' ) {
                         continue;
                     }
                     let condition = params.requirements[_key];
@@ -6532,7 +6777,13 @@ function Routing() {
             //     console.debug('passed '+ params.rule);
             // }
             for (let p in request[method]) {
-                if ( typeof(params.requirements[p]) != 'undefined' && uRo.indexOf(':' + p) < 0 ) {
+                // #B650 — `p` is a key the CLIENT chose, so only a requirement the rule itself
+                // declares may count. A query key named like an Object.prototype member
+                // (toString, valueOf, ...) read as a declared requirement, and each such key
+                // replaced one leading URL segment below: a request reached a rule whose path
+                // differs from its own, past any path-based control applied outside the rule.
+                // was: if ( typeof(params.requirements[p]) != 'undefined' && uRo.indexOf(':' + p) < 0 ) {
+                if ( hasOwn(params.requirements, p) && typeof(params.requirements[p]) != 'undefined' && uRo.indexOf(':' + p) < 0 ) {
                     uRo[uRoCount] = ':' + p;
                     ++uRoCount;
 
@@ -6802,8 +7053,12 @@ function Routing() {
             key     = _param[matched].substring(1);
 
             // No requirements defined for this param — accept any non-empty segment
-            if ( typeof(params.requirements) == 'undefined' || typeof(params.requirements[key]) == 'undefined' ) {
-                if ( typeof(params.param[key]) != 'undefined' && typeof(request.params) != 'undefined' && urlVal ) {
+            // #B650 — a requirement or a param counts only when the rule declares it itself:
+            // an inherited Object.prototype member is neither.
+            // was: if ( typeof(params.requirements) == 'undefined' || typeof(params.requirements[key]) == 'undefined' ) {
+            // was:     if ( typeof(params.param[key]) != 'undefined' && typeof(request.params) != 'undefined' && urlVal ) {
+            if ( typeof(params.requirements) == 'undefined' || typeof(params.requirements[key]) == 'undefined' || !hasOwn(params.requirements, key) ) {
+                if ( typeof(params.param[key]) != 'undefined' && hasOwn(params.param, key) && typeof(request.params) != 'undefined' && urlVal ) {
                     request.params[key] = urlVal;
                     if ( typeof(request[requestMethod][key]) == 'undefined' ) {
                         request[requestMethod][key] = urlVal;
@@ -6872,10 +7127,14 @@ function Routing() {
                 tested = new RegExp(params.requirements[key]).test(urlVal);
             }
 
+            // #B650 — the binding also requires the rule's OWN param and requirement
+            // (was: the same test without the two hasOwn() terms).
             if (
                 typeof(params.param[key]) != 'undefined' &&
+                hasOwn(params.param, key) &&
                 typeof(params.requirements) != 'undefined' &&
                 typeof(params.requirements[key]) != 'undefined' &&
+                hasOwn(params.requirements, key) &&
                 typeof(request.params) != 'undefined' &&
                 tested
             ) {
@@ -12264,29 +12523,61 @@ function DataHelper(){
     };
 
     /**
-     * Convert JSON string with structured keys to object
+     * Parses a request payload into a plain object. Three input shapes:
+     *
+     * - a urlencoded string (`key=value&…`): split on `&`, then at the FIRST `=`,
+     *   each key and value percent-decoded exactly ONCE after the split, bracket
+     *   keys (`user[name]`, `item[0][id]`) nested; a value leaning `{`/`[` is
+     *   parsed as JSON when it parses (JSON carries its own types, so a quoted
+     *   `"true"` inside it stays a string) and kept verbatim otherwise; bare
+     *   `true`/`false`/`on`/`null` stay strings, a value-less segment is dropped,
+     *   a repeated key keeps the last value;
+     * - a `{`/`[`-leading JSON document: parsed VERBATIM — never percent-decoded
+     *   (#B589) — after the quoted-token casting on the document text
+     *   (`"true"`/`"false"`/`"on"` → boolean, `"null"` in any case → null);
+     * - an object: stringified first, so it takes the document contract (the
+     *   browser validator and DTO routes hand their fields over this way).
+     *
+     * A document that does not parse yields `undefined` (and one metadata-only
+     * error line, #B590). A top-level `__proto__`/`constructor`/`prototype` key is
+     * dropped on either path (#B592, #B446).
      *
-     * @param {string} JSON string with structured keys
-     * */
+     * @global
+     * @param {string|object} bodyStr - urlencoded string, JSON document, or object
+     * @returns {object|undefined} the parsed object, or `undefined` for an invalid document
+     * @example
+     *   formatDataFromString('user[name]=Ada&tag=a%26b');   // { user: { name: 'Ada' }, tag: 'a&b' }
+     *   formatDataFromString('{"active":"true","n":"2"}'); // { active: true, n: '2' }
+     *   formatDataFromString({ q: 'a%20b' });               // { q: 'a%20b' }  (never decoded)
+     */
     formatDataFromString = function(bodyStr){
 
-        if ( typeof(bodyStr) == 'object' ) {
+        if ( typeof(bodyStr) == 'object' && bodyStr !== null ) {
             bodyStr = JSON.stringify(bodyStr)
+        } else if ( typeof(bodyStr) != 'string' ) {
+            bodyStr = String(bodyStr);   // undefined / null / a number: `{}` after the split, as before
         }
 
-        try {
-            bodyStr = decodeURIComponent(bodyStr);
-        } catch (err) {
-            // Already decoded - ignoring
-        }
-
-        // false & true case
-        if ( /(\"false\"|\"true\"|\"on\")/.test(bodyStr) ) {
-            bodyStr = bodyStr.replace(/\"false\"/g, false).replace(/\"true\"/g, true).replace(/\"on\"/g, true);
-        }
-        if ( /(\"null\")/i.test(bodyStr) ) {
-            bodyStr = bodyStr.replace(/\"null\"/ig, null);
-        }
+        // #B588 / #B589 — was:
+        //     try {
+        //         bodyStr = decodeURIComponent(bodyStr);
+        //     } catch (err) {
+        //         // Already decoded - ignoring
+        //     }
+        //     // false & true case
+        //     if ( /(\"false\"|\"true\"|\"on\")/.test(bodyStr) ) {
+        //         bodyStr = bodyStr.replace(/\"false\"/g, false).replace(/\"true\"/g, true).replace(/\"on\"/g, true);
+        //     }
+        //     if ( /(\"null\")/i.test(bodyStr) ) {
+        //         bodyStr = bodyStr.replace(/\"null\"/ig, null);
+        //     }
+        // That whole-string decode ran BEFORE the urlencoded split, so an encoded `&`
+        // or `=` inside one value became a separator (#B588); and on a JSON document
+        // — which JSON.stringify never percent-encodes — it re-decoded value TEXT, so
+        // `%22`/`%0A` produced invalid JSON and the whole input was dropped (#B589).
+        // The quoted-token casting is a DOCUMENT feature and now runs inside
+        // parseBody's document branch only; a urlencoded pair is never coerced (bare
+        // tokens never were).
 
         return parseBody(bodyStr);
     }
@@ -12311,6 +12602,12 @@ function DataHelper(){
 
         for (let o in tmp) {
 
+            // #B592 — a top-level `__proto__` (an OWN key, which JSON.parse produces),
+            // `constructor` or `prototype` assigned flat below would swap the prototype
+            // of the RESULT object; drop the pair. Bracket paths are guarded per segment
+            // inside parseLocalObj (#B446).
+            if ( o === '__proto__' || o === 'constructor' || o === 'prototype' ) continue;
+
             el[0]   = o;
             el[1]   = tmp[o];
 
@@ -12325,6 +12622,29 @@ function DataHelper(){
         return obj
     }
 
+    /**
+     * The one line a parse failure may log: the input's LENGTH and the error's NAME —
+     * never the input, and never `err.message` (#B590). On the server the input is a
+     * request body or the whole serialized query string, i.e. credentials and tokens
+     * typed by a visitor; and this helper is browser-bundled, so the same line reaches
+     * the console. The message is no safer than the input: a `JSON.parse` message can
+     * quote the input itself — V8's "Unexpected token" form embeds the text around the
+     * offending character, and JavaScriptCore's names the offending token.
+     *
+     * @inner
+     * @private
+     * @param {*} input - the text that failed to parse
+     * @param {Error} err - the parse error
+     * @returns {string} e.g. `42 chars (SyntaxError)`
+     * @example
+     *   describeParseFailure('{"a":', new SyntaxError('x')); // '5 chars (SyntaxError)'
+     */
+    var describeParseFailure = function(input, err) {
+        var len  = ( typeof(input) == 'string' ) ? input.length : -1;
+        var name = ( err && err.name ) ? err.name : 'Error';
+        return len + ' chars (' + name + ')';
+    };
+
     var parseBody = function(body) {
         var obj             = null
             , tmp           = null
@@ -12337,10 +12657,21 @@ function DataHelper(){
                 obj = ( isArrayType ) ? [] : {};
 
                 if ( /^(\%7B|\%5B)/.test(body) ) {
-                    tmp = JSON.parse(decodeURIComponent(body))
-                } else {
-                    tmp = JSON.parse(body)
+                    // a fully percent-encoded document (a direct caller's shape, never the
+                    // request pipeline's): decoded ONCE, then treated like a raw document
+                    body = decodeURIComponent(body)
+                }
+                // #B588 / #B589 — the quoted-token casting, moved here from
+                // formatDataFromString: `"true"`/`"false"`/`"on"` -> boolean and `"null"`
+                // (any case) -> null, on the DOCUMENT text only. An escaped occurrence
+                // inside a longer value (`\"true\"`) never matches.
+                if ( /(\"false\"|\"true\"|\"on\")/.test(body) ) {
+                    body = body.replace(/\"false\"/g, false).replace(/\"true\"/g, true).replace(/\"on\"/g, true);
                 }
+                if ( /(\"null\")/i.test(body) ) {
+                    body = body.replace(/\"null\"/ig, null);
+                }
+                tmp = JSON.parse(body)
 
                 if ( Array.isArray(tmp) ) {
                     obj = parseCollection(tmp, obj)
@@ -12350,67 +12681,62 @@ function DataHelper(){
 
                 return obj
             } catch (err) {
-                console.error('[365] could not parse body:\n' + body)
+                // #B590 — metadata only (see describeParseFailure); the leading character
+                // is one of `{`, `[` or `%` here, by the branch's own test.
+                // was: console.error('[365] could not parse body:\n' + body)
+                console.error('[365] could not parse body: ' + describeParseFailure(body, err) + ', leading ' + body.charAt(0))
             }
 
         } else {
+            // #B588 — the standard form algorithm (the WHATWG urlencoded parser): split
+            // on `&`, split each pair at the FIRST `=`, then percent-decode the key and
+            // the value exactly ONCE. The loop it replaces decoded each whole segment
+            // BEFORE its `=` split (`field=a%3Db` lost everything after `a`), split on
+            // every `=` keeping only the first two parts, decoded key and value once
+            // more, let a `{`-leading segment REPLACE the accumulator and stop, dropped
+            // a value that merely started with `{`/`[` when it was not JSON, skipped a
+            // value containing `[object `, and probed values for a literal `{}":`. Kept
+            // as before: a value-less segment is dropped, an empty value is `''`, a
+            // repeated key keeps the last value, bracket keys nest through parseLocalObj,
+            // and no bare-token coercion happens on this path.
             obj = {};
             arr = body.split(/&/g);
-            if ( /(\"false\"|\"true\"|\"on\")/.test(body) )
-                body = body.replace(/\"false\"/g, false).replace(/\"true\"/g, true).replace(/\"on\"/g, true);
-
 
-            var el      = {}
+            var idx     = -1
+                , key   = null
                 , value = null
-                , key   = null;
+                , path  = null;
 
             for (var i = 0, len = arr.length; i < len; ++i) {
                 if (!arr[i]) continue;
 
-                // #B30: tolerate a malformed `%` escape (fall back to the raw
-                // segment) instead of letting decodeURIComponent throw URIError —
-                // an unguarded throw here propagates to processRequestData with no
-                // uncaughtException handler and crashes the bundle.
-                arr[i] = safeDecodeURIComponent(arr[i]);
+                idx = arr[i].indexOf('=');
+                if (idx < 0) continue;                                   // a value-less segment: dropped, as before
 
-                if ( /^\{/.test(arr[i]) || /\=\{/.test(arr[i]) || /\=\[/.test(arr[i]) ) {
-                    try {
-                        if (/^\{/.test(arr[i])) {
-                            obj = JSON.parse(arr[i]);
-                            break;
-                        } else {
-                            el = arr[i].match(/\=(.*)/);
-                            el[0] =  arr[i].split(/\=/)[0];
-                            obj[ el[0] ] = JSON.parse( el[1] );
-                        }
+                // #B30: malformed-%-safe decode (raw fallback, never a throw) — once, after the split.
+                key   = safeDecodeURIComponent(arr[i].substring(0, idx));
+                value = safeDecodeURIComponent(arr[i].substring(idx + 1));
 
+                // #B592 — a whole key named after the prototype accessors would swap the
+                // prototype of the result (a JSON-valued `__proto__`) or shadow it: drop the
+                // pair. Bracket paths are guarded per segment inside parseLocalObj (#B446).
+                if ( key === '__proto__' || key === 'constructor' || key === 'prototype' ) continue;
 
-                    } catch (err) {
-                        console.error('[parseBody#1] could not parse body:\n' + arr[i])
-                    }
-                } else {
-                    el = arr[i].split(/=/);
-                    if ( /\{\}\"\:/.test(el[1]) ) { //might be a json
-                        try {
-                            el[1] = JSON.parse(el[1])
-                        } catch (err) {
-                            console.error('[parseBody#2] could not parse body:\n' + el[1])
-                        }
+                // a JSON value (`filter={"a":1}`, `list=[1,2]`, or their encoded forms) is
+                // parsed when it parses and kept VERBATIM otherwise (`note={name}` is text)
+                if ( /^[\{\[]/.test(value) ) {
+                    try {
+                        value = JSON.parse(value);
+                    } catch (notAJsonValue) {
+                        // not JSON after all — keep the text
                     }
+                }
 
-                    if ( typeof(el[1]) == 'string' && !/\[object /.test(el[1])) {
-                        key     = null;
-                        // #B30: malformed-%-safe decode (see the arr[] loop above).
-                        el[0]   = safeDecodeURIComponent(el[0]);
-                        el[1]   = safeDecodeURIComponent(el[1]);
-
-                        if ( /^(.*)\[(.*)\]/.test(el[0]) ) { // some[field] ?
-                            key = el[0].replace(/\]/g, '').split(/\[/g);
-                            obj = parseLocalObj(obj, key, 0, el[1])
-                        } else {
-                            obj[ el[0] ] = el[1]
-                        }
-                    }
+                if ( /^(.*)\[(.*)\]/.test(key) ) { // some[field] ?
+                    path = key.replace(/\]/g, '').split(/\[/g);
+                    obj  = parseLocalObj(obj, path, 0, value)
+                } else {
+                    obj[ key ] = value
                 }
             }
 
@@ -12497,10 +12823,21 @@ function DataHelper(){
                 }
                 // Assinging index or key
                 else {
-                    if ( /^\d+$/.test(key[k]) && !Array.isArray(obj) ) {
-                        obj = [];
-                        // _key = (obj.length > 0) ? obj.length-1 : 0;
-                    }
+                    // #B591 — was:
+                    //     if ( /^\d+$/.test(key[k]) && !Array.isArray(obj) ) {
+                    //         obj = [];
+                    //         // _key = (obj.length > 0) ? obj.length-1 : 0;
+                    //     }
+                    // That rebind meant "a numeric segment turns this level into an array", but
+                    // it only rebound the LOCAL: the parent never saw the new array, the slot
+                    // below was then seeded with null, and the recursion dereferenced it — every
+                    // path through it threw a TypeError (`0[a]=1`, `a[x]=1&a[0][b]=2`), and from
+                    // the GET/HEAD `inheritedData` call site that throw had no try/catch and
+                    // exited the bundle process. Arrays are built by the look-ahead above (the
+                    // slot is created as an array when the NEXT segment is numeric); a numeric
+                    // segment under an object now simply creates a plain object slot, so
+                    // `0[a]=1` nests as the key `0` holding `a`. The client twin in the
+                    // validator plugin carries the same removal.
                     // Handle unstructured array from object
                     // E.G.: design[1][id] where design is starting with `1` index instead of `0`
                     // if ( Array.isArray(obj) ) {
@@ -15410,11 +15747,11 @@ function ValidatorPlugin(rules, data, formId, culture) {
      * current level an array.
      *
      * @inner
-     * @param {(object|Array)} obj - accumulator, mutated in place (may be replaced when the head segment is numeric — assign the return value)
+     * @param {(object|Array)} obj - accumulator, mutated in place and returned
      * @param {Array<string>} key - the split key path, e.g. `item[0][id]` -> `['item','0','id']`
      * @param {number} k - current recursion depth into `key`
      * @param {*} value - the field value to assign at the leaf
-     * @returns {(object|Array)} the (possibly replaced) accumulator
+     * @returns {(object|Array)} the accumulator (never a replacement — #B591 removed the rebind that pretended otherwise)
      *
      * @example
      * // 'item[0][id]' -> ['item','0','id']
@@ -15461,9 +15798,15 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 }
                 // Assigning index or key
                 else {
-                    if ( /^\d+$/.test(key[k]) && !Array.isArray(obj) ) {
-                        obj = [];
-                    }
+                    // #B591 — was:
+                    //     if ( /^\d+$/.test(key[k]) && !Array.isArray(obj) ) {
+                    //         obj = [];
+                    //     }
+                    // The rebind only rebound the LOCAL, the slot below was then seeded with
+                    // null and the recursion dereferenced it: every path through it threw, so
+                    // a field named `0[a]` broke the whole submission. Same removal as the
+                    // server helper (helpers/data `parseLocalObj`); a numeric segment under an
+                    // object now creates a plain object slot.
                     // Init array or object
                     if ( typeof(obj[ _key ]) == 'undefined' ) {
                         obj[ _key ] = null;
@@ -23987,6 +24330,58 @@ function ValidatorPlugin(rules, data, formId, culture) {
         }
     }
 
+    /**
+     * escapeForJsonString
+     * Escapes a value for use INSIDE a JSON string literal: `"`, `\` and the
+     * control characters U+0000 to U+001F, exactly what JSON requires and
+     * nothing else, so a value carrying none of them comes back unchanged
+     * (#B600). A lone surrogate is left as it is on purpose: it never broke a
+     * parse, so escaping it would only change bytes. `form-validator.js`
+     * carries the same function for the query-body splice.
+     *
+     * @inner
+     * @param {*} value - coerced with `String()`
+     * @returns {string} the escaped text, without surrounding quotes
+     *
+     * @example
+     * escapeForJsonString('say "hi"'); // the text: say \"hi\"
+     */
+    var escapeForJsonString = function(value) {
+        return String(value).replace(/[\u0000-\u001f"\\]/g, function(ch) {
+            switch (ch) {
+                case '"'  : return '\\"';
+                case '\\' : return '\\\\';
+                case '\b' : return '\\b';
+                case '\f' : return '\\f';
+                case '\n' : return '\\n';
+                case '\r' : return '\\r';
+                case '\t' : return '\\t';
+                default   : return '\\u' + ('000' + ch.charCodeAt(0).toString(16)).slice(-4);
+            }
+        });
+    }
+
+    /**
+     * quoteForDynamisedRules
+     * Returns `value` as a quoted string operand, ready to splice into the
+     * STRINGIFIED rule set that `getDynamisedRules` parses back (#B600). Two
+     * levels of escaping: the inner one makes `"<value>"` a JSON string
+     * literal, the operand `is()` decodes; the outer one embeds that literal in
+     * the rule set's own JSON text. For a value with no `"`, `\` or control
+     * character the result is exactly the historical `\"<value>\"` splice.
+     *
+     * @inner
+     * @param {*} value - coerced with `String()`
+     * @returns {string} the splice text
+     *
+     * @example
+     * quoteForDynamisedRules('abc');   // the text: \"abc\"   (unchanged)
+     * quoteForDynamisedRules('ab"cd'); // the text: \"ab\\\"cd\" (the rule set parses it to "ab\"cd")
+     */
+    var quoteForDynamisedRules = function(value) {
+        return '\\"' + escapeForJsonString(escapeForJsonString(value)) + '\\"';
+    }
+
     /**
      * getCastedValue
      * Returns the value to use for `fieldName` — raw for the engine to
@@ -24046,6 +24441,19 @@ function ValidatorPlugin(rules, data, formId, culture) {
             if ( /\,/.test(fields[fieldName]) ) {
                 fields[fieldName] = fields[fieldName].replace(/\,/g, '.').replace(/\s+/g, '');
             }
+            // #B600 — in dynamised mode this value is spliced into the stringified rule
+            // set, so only a NUMBER goes in raw: a numeric comparison must stay numeric,
+            // and the condition grammar reads the space padding around it. Anything else
+            // is spliced as an escaped string operand and compares as text; it all went
+            // in raw, so a `"` or `\` typed into a number field broke the closing parse.
+            if (
+                isOnDynamisedRules
+                && typeof(fields[fieldName]) != 'number'
+                && typeof(fields[fieldName]) != 'boolean'
+                && !/^ *-?\d+(?:\.\d+)? *$/.test(fields[fieldName])
+            ) {
+                return quoteForDynamisedRules(fields[fieldName]);
+            }
             return fields[fieldName];
         }
 
@@ -24064,7 +24472,10 @@ function ValidatorPlugin(rules, data, formId, culture) {
             return (/^true$/i.test(fields[fieldName])) ? true : false;
         }
 
-        return isOnDynamisedRules ? '\\"'+ fields[fieldName] +'\\"' : fields[fieldName];
+        // #B600 — escaped inside its quotes (quoteForDynamisedRules); the value was
+        // concatenated between them verbatim, so a `"`, `\` or control character in
+        // it broke the closing parse of the whole rule set.
+        return isOnDynamisedRules ? quoteForDynamisedRules(fields[fieldName]) : fields[fieldName];
     }
 
     /**
@@ -24088,6 +24499,30 @@ function ValidatorPlugin(rules, data, formId, culture) {
         return fields;
     }
 
+    /**
+     * getDynamisedRules
+     * Resolves every `$<field>` token of the STRINGIFIED rule set with that
+     * field's value — cast through `getCastedValue` when the field carries a
+     * rule, quoted through `quoteForDynamisedRules` otherwise — and parses the
+     * result back. Under a live check on a single element the whole form's
+     * fields are (re)collected first, since a condition may compare the element
+     * with a sibling.
+     *
+     * One pass through the engine's tokenizer (#B603): the per-name loop that
+     * preceded it re-scanned the whole rule set after every splice, so a value
+     * holding `$<otherField>` was substituted a second time whenever that field
+     * came later in the descending walk — and its DOM-fallback second loop
+     * (#B234) could only ever act on a `$` a spliced value had carried in.
+     *
+     * @inner
+     * @param {string} stringifiedRules - `JSON.stringify(rules)`
+     * @param {object} fields - the collected field values (name -> value)
+     * @param {object|null} $fields - the DOM handles (null on the server paths)
+     * @param {boolean} isLiveCheckingOnASingleElement - a live check on one element
+     * @returns {object} the rule set with every token resolved — or, should the
+     *   result not parse, the rules as declared (the engine then resolves or
+     *   fails closed)
+     */
     var getDynamisedRules = function(stringifiedRules, fields, $fields, isLiveCheckingOnASingleElement) {
 
         // Because this could also be live check, if it is the case, we need all fields
@@ -24095,7 +24530,6 @@ function ValidatorPlugin(rules, data, formId, culture) {
         // meant to validate one field at the time, you could fall in a case where the current
         // field should be compared with another field of the same form.
         var ruleObj = JSON.parse(stringifiedRules.replace(/\"(true|false)\"/gi, '$1'));
-        var stringifiedRulesTmp = JSON.stringify(ruleObj);
         if (isLiveCheckingOnASingleElement) {
             var $currentForm    = $fields[Object.getOwnPropertyNames($fields)[0]].form;
             var vInfos          = getFormValidationInfos($currentForm, ruleObj);
@@ -24105,62 +24539,37 @@ function ValidatorPlugin(rules, data, formId, culture) {
             $fields = vInfos.$fields;
         }
 
-
-        var re = null, _field = null, arrFields = [], a = 0;
-        // avoiding conflict like ["myfield", "myfield-name"]
-        // where once `myfield` is replaced for exemple with `1234`, you also get 1234-name left behind
-        // TODO - Replace this trick with a RegExp matching only the exact word
-        // TODO - test this one:
-        //          \W(\$myfield-name)(?!-)\W
+        var arrFields = [], spliced = {};
         for (let field in fields) {
-            arrFields[a] = field;
-            a++;
-        }
-        arrFields.sort().reverse();
-
-        for (let i = 0, len = arrFields.length; i < len; i++) {
-            _field = arrFields[i].replace(/\-|\_|\@|\#|\.|\[|\]/g, '\\$&');
-            re = new RegExp('\\$'+_field, 'g');
-            // default field value
-            let fieldValue = '\\"'+ fields[arrFields[i]] +'\\"';
-            let isInRule = re.test(stringifiedRulesTmp);
-            if ( isInRule && typeof(ruleObj[arrFields[i]]) != 'undefined' ) {
-                fieldValue = getCastedValue(ruleObj, fields, arrFields[i], true);
-            } else if ( isInRule ) {
-                console.warn('`'+arrFields[i]+'` is used in a dynamic rule without definition. This could lead to an evaluation error. Casting `'+arrFields[i]+'` to `string`.');
-            }
-
-            stringifiedRules = stringifiedRules.replace(re, fieldValue );
-        }
-        // #B234 — this second loop is a DOM FALLBACK: it re-derives each splice
-        // value from the live element (`$fields[...].value` / `.checked`), and
-        // the server auto path (`backendInit`) passes `$fields = null`, so ANY
-        // `$` surviving loop 1 threw here — a regex end-anchor in an `is`
-        // condition, or a `$` inside a human-readable message string. Loop 1
-        // already replaces every KNOWN field's token, so what reaches loop 2 is
-        // a leftover it structurally cannot match anyway: skipping when there is
-        // no DOM matches what the client does when this re-scan no-ops, and
-        // leaves every previously-working substitution byte-identical. Same
-        // `$fields &&` guard shape as the #B127 precedent one function later.
-        // was: `if ( /\$(.*)/.test(stringifiedRules) ) {`
-        if ( $fields && /\$(.*)/.test(stringifiedRules) ) {
-            for (let i = 0, len = arrFields.length; i < len; i++) {
-                _field = arrFields[i].replace(/\-|\_|\@|\#|\.|\[|\]/g, '\\$&');
-                re = new RegExp('\\$'+_field, 'g');
-                // default field value
-                let fieldValue = ($fields[arrFields[i]].value != '' ) ? '\\"'+ $fields[arrFields[i]].value +'\\"' : '\\"\\"';
-                let isInRule = re.test(stringifiedRulesTmp);
-                if ( isInRule && typeof(ruleObj[arrFields[i]]) != 'undefined' ) {
-                    fieldValue = getCastedValue(ruleObj, fields, arrFields[i], true);
-                } else if ( isInRule ) {
-                    console.warn('`'+arrFields[i]+'` is used in a dynamic rule without definition. This could lead to an evaluation error. Casting `'+arrFields[i]+'` to `string`.');
-                }
-
-                stringifiedRules = stringifiedRules.replace(re, fieldValue || $fields[arrFields[i]].checked);
-            }
-        }
-
-        return JSON.parse(stringifiedRules)
+            arrFields.push(field);
+        }
+        // #B603 — the tokenizer picks the longest name and never scans a replacement
+        // again; the resolver runs once per NAME (cast once, warn once).
+        stringifiedRules = FormValidator.substituteFieldTokens(stringifiedRules, arrFields, function(field) {
+            if ( typeof(spliced[field]) != 'undefined' ) {
+                return spliced[field];
+            }
+            // default field value (#B600 — escaped inside its quotes, see quoteForDynamisedRules)
+            let fieldValue = quoteForDynamisedRules(fields[field]);
+            if ( typeof(ruleObj[field]) != 'undefined' ) {
+                fieldValue = getCastedValue(ruleObj, fields, field, true);
+            } else {
+                console.warn('`'+field+'` is used in a dynamic rule without definition. This could lead to an evaluation error. Casting `'+field+'` to `string`.');
+            }
+            spliced[field] = fieldValue;
+            return fieldValue;
+        });
+
+        // #B600 — a splice can no longer break this parse (every value is escaped), but
+        // a failure here must never throw out of the validation pass: fall back to the
+        // rules as declared, whose `$` references the engine's own is() substitution
+        // then resolves or fails closed (the #B82 precedent: fail the field, never the pass).
+        try {
+            return JSON.parse(stringifiedRules);
+        } catch (parseErr) {
+            console.warn('[FormValidator] Could not parse the dynamised rules - validating against the rules as declared.\n(' + parseErr.message + ')');
+            return ruleObj;
+        }
     }
 
 
@@ -24219,13 +24628,14 @@ function ValidatorPlugin(rules, data, formId, culture) {
         /**
          * Apply every rule declared for one field to the FormValidator instance `d`.
          *
-         * Array-form rules (`isInList: [...]`) get their FIRST argument scanned for
-         * `$`-prefixed tokens; a token resolving to a real field (a `d` key with a
+         * Array-form rules (`isInList: [...]`) — except `is` / `is<N>`, whose
+         * condition the engine resolves itself (#B603) — get their FIRST argument
+         * scanned for `$`-prefixed tokens; a token resolving to a real field (a `d` key with a
          * defined `.value`) is substituted with that value, anything else stays
          * LITERAL (#B239 — the blind deref crashed on unknown names and spliced
          * "undefined" on engine-method-name collisions). Later elements are never
          * scanned. Cross-field refs inside array rules are consumed upstream by
-         * getDynamisedRules loop 1 (quoted — #B240), so in practice only leftover
+         * getDynamisedRules (quoted — #B240), so in practice only leftover
          * non-field tokens reach the scan here.
          *
          * @inner
@@ -24329,7 +24739,12 @@ function ValidatorPlugin(rules, data, formId, culture) {
                     if (Array.isArray(rules[field][rule])) { // has args
                         //convert array to arguments
                         args = JSON.clone(rules[field][rule]);
-                        if ( /\$[\-\w\[\]]*/.test(args[0]) ) {
+                        // #B603 — an `is` / `is<N>` condition is the ENGINE's to resolve
+                        // (getDynamisedRules has already spliced every known field as a
+                        // string literal, and is() resolves tokens outside literals only):
+                        // this raw first-occurrence replace re-hit a `$<field>` a spliced
+                        // VALUE carried in, so the two-argument `is` form mismatched on it.
+                        if ( !/^is\d*$/.test(rule) && /\$[\-\w\[\]]*/.test(args[0]) ) {
                             var foundVariables = args[0].match(/\$[\-\w\[\]]*/g);
                             for (var v = 0, vLen = foundVariables.length; v < vLen; ++v) {
                                 // #B239 — the deref used to be blind, throwing
@@ -24341,7 +24756,7 @@ function ValidatorPlugin(rules, data, formId, culture) {
                                 // defined keys with no `.value`). A token that does not
                                 // resolve to a real field now stays LITERAL, so strict
                                 // comparison applies. Cross-field refs inside array
-                                // rules remain owned by #B240 (upstream loop-1 quoting).
+                                // rules remain owned by #B240 (upstream getDynamisedRules quoting).
                                 // was: args[0] = args[0].replace( foundVariables[v], d[foundVariables[v].replace('$', '')].value )
                                 var _refName = foundVariables[v].replace('$', '');
                                 if (
@@ -30523,16 +30938,35 @@ function Collection(content, options) {
     //         throw new Error('Could not evaluate condition `'+ condition +'`.\n' + err.stack );
     //     }
     // }
-    var CONDITION_RE = /^\s*(new\s+Date\("[^"]*"\)|"[^"]*"|-?\d+(?:\.\d+)?)\s*(===|!==|<=|>=|==|!=|<|>)\s*(new\s+Date\("[^"]*"\)|"[^"]*"|-?\d+(?:\.\d+)?)\s*$/;
+    // #B609 — the string operand now accepts JSON escapes (`\"`, `\\`, …) so a value
+    // containing a quote or backslash cannot break the grammar. Previously the operand
+    // was `"[^"]*"`, which no escaped quote could satisfy: a single row whose string
+    // value held a `"` threw and poisoned the whole query.
+    var CONDITION_RE = /^\s*(new\s+Date\("[^"]*"\)|"(?:\\.|[^"\\])*"|-?\d+(?:\.\d+)?)\s*(===|!==|<=|>=|==|!=|<|>)\s*(new\s+Date\("[^"]*"\)|"(?:\\.|[^"\\])*"|-?\d+(?:\.\d+)?)\s*$/;
     var parseOperand = function(s) {
         var m = s.match(/^\s*new\s+Date\("([^"]*)"\)\s*$/);
         if (m) return new Date(m[1]);
         var t = s.replace(/^\s+|\s+$/g, '');
-        if (/^"[^"]*"$/.test(t)) return t.slice(1, -1);
+        if (/^"(?:\\.|[^"\\])*"$/.test(t)) return JSON.parse(t);
         var n = Number(t);
         if (!isNaN(n) && t !== '') return n;
         throw new Error('Invalid operand: `'+ s +'`');
     };
+    // #B609 — build a safe `<left><op><right>` condition for a STRING left operand:
+    // strip the full operator (every form the grammar admits, longest first), trim the
+    // compared value, tolerate a pre-quoted operand, and JSON-encode both sides so a
+    // quote/backslash in a value — or an operator character inside the operand — can no
+    // longer corrupt the expression. The numeric and datetime paths are left untouched.
+    var STRING_OP_RE = /^(===|!==|<=|>=|==|!=|<|>)/;
+    var buildStringCondition = function(left, filter) {
+        var fs = String(filter);
+        var m = fs.match(STRING_OP_RE);
+        if (!m) { return JSON.stringify(String(left)) + fs; }
+        var op = m[1];
+        var right = fs.slice(op.length).replace(/^\s+|\s+$/g, '');
+        if (/^"(?:\\.|[^"\\])*"$/.test(right)) { right = JSON.parse(right); }
+        return JSON.stringify(String(left)) + op + JSON.stringify(right);
+    };
     var tryEval     = function(condition) {
         var m = (typeof(condition) == 'string') ? condition.match(CONDITION_RE) : null;
         if (!m) {
@@ -30802,16 +31236,15 @@ function Collection(content, options) {
                     && !/undefined|function/.test(typeof(_content))
                     && !searchOptionRules.skipEval
                 ) { // with operations
-                    let originalFilter = filter;
                     let condition = _content + filter;
                     if ( typeof(filter) == 'string' && typeof(_content) == 'string' ) {
-                        let comparedValue = filter.replace(/^(<=|>=|!==|!=|===|!==)/g, '');
-                        if ( typeof(_content) == 'string' && !/^\"(.*)\"$/.test(comparedValue) ) {
-                            filter = filter.replace(comparedValue, '\"'+ comparedValue + '\"');
-                        }
-                        condition = '\"'+_content+'\"' + filter;
-                        // restoring in case of datetime eval
-                        filter = originalFilter;
+                        // #B609 — was: quote `_content` and the partially-stripped filter,
+                        // then concat. That threw on a `"` in either operand, failed to strip
+                        // `==`/`>`/`<` (so the operator leaked into the operand), and kept a
+                        // leading space in the compared value (wrong rows). Build both operands
+                        // safely instead. `filter` is no longer mutated, so the datetime path
+                        // below still sees the original string.
+                        condition = buildStringCondition(_content, filter);
                     }
 
                     // looking for a datetime ?
@@ -30944,6 +31377,12 @@ function Collection(content, options) {
                                 ++matched;
                             }
 
+                        } else if (typeof(value) == 'string') {
+                            // #B609 — a string value must be JSON-encoded like the find() path;
+                            // `value + filter` (unquoted) threw for every string comparison here.
+                            if (tryEval(buildStringCondition(value, filter))) {
+                                ++matched;
+                            }
                         } else if (tryEval(value + filter)) {
 
                             ++matched;