poe-code 14.0.74 → 14.0.75

package/packages/safe-js/dist/cli.js

@@ -22,7 +22,7 @@ import {
   resolveFsConfig,
   splitFrontmatter,
   withBrokenPipeGuard
-} from "./chunks/chunk-2J6W3YGB.js";
+} from "./chunks/chunk-BAJI3K4B.js";
 import {
   Budget,
   SandboxError,
@@ -34,7 +34,7 @@ import {
   replaceErrorStack,
   restore,
   run
-} from "./chunks/chunk-YEZOXLY4.js";
+} from "./chunks/chunk-EOTY4PCT.js";
 import "./chunks/chunk-ZWJ5BJUI.js";
 import "./chunks/chunk-3YTQEPZI.js";
 import "./chunks/chunk-4YIDX44G.js";

package/packages/safe-js/dist/core.js

@@ -5,7 +5,7 @@ import {
   defineExtension,
   lint,
   run
-} from "./chunks/chunk-YEZOXLY4.js";
+} from "./chunks/chunk-EOTY4PCT.js";
 import "./chunks/chunk-4YIDX44G.js";
 export {
   Budget,

package/packages/safe-js/dist/index.js

@@ -26,7 +26,7 @@ import {
   runWithSpawnUsageAccumulator,
   splitFrontmatter,
   supportsSpawnMode
-} from "./chunks/chunk-2J6W3YGB.js";
+} from "./chunks/chunk-BAJI3K4B.js";
 import {
   Budget,
   FileSnapshotBackend,
@@ -50,7 +50,7 @@ import {
   registerPendingHostCallPolicy,
   restore,
   run
-} from "./chunks/chunk-YEZOXLY4.js";
+} from "./chunks/chunk-EOTY4PCT.js";
 import "./chunks/chunk-ZWJ5BJUI.js";
 import "./chunks/chunk-3YTQEPZI.js";
 import "./chunks/chunk-4YIDX44G.js";

package/packages/safe-js/dist/interp/globals/regex.js

@@ -1,12 +1,17 @@
-import { createSandboxClosure, createSandboxRegex, isSandboxRegex, reconcileCompiledValues } from "../values.js";
+import { createSandboxClosure, createSandboxRegex, isSandboxClosure, isSandboxRegex, reconcileCompiledValues } from "../values.js";
 import { CompileScope } from "../regex/compile-guard.js";
 import { SandboxError } from "../budget.js";
-import { sandboxString } from "../string-coercion.js";
+import { sandboxNumber, sandboxString } from "../string-coercion.js";
 import { getSandboxPropertyDescriptor, installRegexPrototype, materializeFunctionProperties, setSandboxPrototype } from "../object-model.js";
 import { accessorAdapter, readPropertyDescriptor } from "../accessors.js";
 import { callRegexMethod, getRegexMember, regexFlagProperties, regexSearch } from "../methods/regex.js";
 import { regexMatch, regexReplace } from "../methods/string.js";
 import { invokeBuiltinClosure } from "../builtin-call.js";
+import { restoreSandboxRegExpIterator } from "../regexp-iterator.js";
+import { normalizeLastIndex } from "../regex/engine.js";
+import { retainValues } from "../resources.js";
+import { setSandboxProperty } from "../interpreter.js";
+import { regexSplit } from "../methods/regex-split.js";
 export function createRegexGlobals(options) {
     const invoke = (construct) => async (args, context) => {
         const selected = options.compileOwner ?? context?.compilation?.owner;
@@ -75,7 +80,52 @@ export function createRegexGlobals(options) {
         }
     };
     const constructor = createSandboxClosure({ guest: true, sandbox: true, name: "RegExp", length: 2, call: invoke(false), construct: invoke(true) });
+    Object.defineProperty(materializeFunctionProperties(constructor), "escape", {
+        value: createSandboxClosure({ guest: true, sandbox: true, name: "escape", length: 1,
+            call: (args) => {
+                const input = args[0];
+                if (typeof input !== "string")
+                    throw new TypeError("RegExp.escape requires a string.");
+                const allocation = {};
+                let escaped = "";
+                try {
+                    for (const character of input) {
+                        options.budget.visitNode();
+                        const point = character.codePointAt(0);
+                        let part = character;
+                        if (escaped.length === 0 && ((point >= 48 && point <= 57) ||
+                            (point >= 65 && point <= 90) || (point >= 97 && point <= 122))) {
+                            part = `\\x${point.toString(16)}`;
+                        }
+                        else if ("^$\\.*+?()[]{}|/".includes(character)) {
+                            part = "\\" + character;
+                        }
+                        else {
+                            const control = "\f\n\r\t\v".indexOf(character);
+                            if (control !== -1)
+                                part = "\\" + "fnrtv"[control];
+                            else if (",-=<>#&!%:;@~'`\"".includes(character) || character.trim() === "" ||
+                                (point >= 0xd800 && point <= 0xdfff)) {
+                                part = point <= 0xff ? `\\x${point.toString(16).padStart(2, "0")}`
+                                    : `\\u${point.toString(16).padStart(4, "0")}`;
+                            }
+                        }
+                        options.budget.setRetainedDataUsage(allocation, escaped.length + part.length);
+                        escaped = options.budget.allocateString(escaped + part);
+                    }
+                    return escaped;
+                }
+                finally {
+                    options.budget.setRetainedDataUsage(allocation, 0);
+                }
+            }
+        }), writable: true, configurable: true
+    });
     const prototype = Object.create(null);
+    Object.defineProperty(materializeFunctionProperties(constructor), Symbol.species, {
+        get: accessorAdapter(createSandboxClosure({ sandbox: true, name: "get [Symbol.species]", length: 0,
+            call: (_args, context) => context?.thisValue }), "get"), configurable: true
+    });
     Object.defineProperty(materializeFunctionProperties(constructor), "prototype", { value: prototype, writable: false });
     Object.defineProperty(prototype, "constructor", { value: constructor, writable: true, configurable: true });
     Object.defineProperty(prototype, Symbol.search, {
@@ -93,6 +143,62 @@ export function createRegexGlobals(options) {
             call: (args, context) => regexReplace(args[0], context?.thisValue, args[1], options.budget, (closure, values) => invokeBuiltinClosure(closure, values, options.budget, context, undefined), context) }),
         writable: true, configurable: true
     });
+    Object.defineProperty(prototype, Symbol.matchAll, {
+        value: createSandboxClosure({ guest: true, sandbox: true, name: "[Symbol.matchAll]", length: 1,
+            call: async (args, context) => {
+                const target = context?.thisValue;
+                if (target === null || typeof target !== "object")
+                    throw new TypeError("RegExp matchAll requires an object receiver.");
+                let input = args[0];
+                let string;
+                let species;
+                let field;
+                let flags;
+                let matcher;
+                const release = retainValues(options.budget, () => [target, input, string, species, field, flags, matcher]);
+                const read = (value, key) => {
+                    if (context?.getProperty !== undefined)
+                        return context.getProperty(value, key);
+                    const descriptor = getSandboxPropertyDescriptor(value, key, options.budget);
+                    return descriptor === undefined ? undefined : readPropertyDescriptor(descriptor, value, context);
+                };
+                try {
+                    string = await sandboxString(input, options.budget, context);
+                    input = undefined;
+                    field = await read(target, "constructor");
+                    species = constructor;
+                    if (field !== undefined) {
+                        if (field === null || typeof field !== "object")
+                            throw new TypeError("Invalid RegExp species constructor.");
+                        species = await read(field, Symbol.species);
+                        if (species === null || species === undefined)
+                            species = constructor;
+                    }
+                    field = undefined;
+                    if (!isSandboxClosure(species) || species.construct === undefined)
+                        throw new TypeError("RegExp species must be a constructor.");
+                    field = await read(target, "flags");
+                    flags = await sandboxString(field, options.budget, context);
+                    field = undefined;
+                    matcher = await invokeBuiltinClosure(species, [target, flags], options.budget, context, undefined, true);
+                    field = await read(target, "lastIndex");
+                    const cursor = normalizeLastIndex(await sandboxNumber(field, options.budget, context));
+                    field = undefined;
+                    await setSandboxProperty(matcher, "lastIndex", cursor, options.budget, true, context);
+                    return restoreSandboxRegExpIterator({ matcher, input: string, exhausted: false,
+                        global: flags.includes("g"), unicode: flags.includes("u") || flags.includes("v") });
+                }
+                finally {
+                    release();
+                }
+            } }),
+        writable: true, configurable: true
+    });
+    Object.defineProperty(prototype, Symbol.split, {
+        value: createSandboxClosure({ guest: true, sandbox: true, name: "[Symbol.split]", length: 2,
+            call: (args, context) => regexSplit(context?.thisValue, args[0], args[1], constructor, options.budget, context) }),
+        writable: true, configurable: true
+    });
     for (const name of ["exec", "test", "toString"]) {
         Object.defineProperty(prototype, name, {
             value: createSandboxClosure({ sandbox: true, name, length: name === "toString" ? 0 : 1,

package/packages/safe-js/dist/interp/iteration.js

@@ -5,7 +5,7 @@ import { boxedValue, isSandboxBox } from "./boxed.js";
 import { getHostObjectIterator, isGuestHostObject } from "./host-capabilities.js";
 import { isSandboxCollectionIterator, nextCollectionIterator } from "./collection-iterator.js";
 import { isSandboxRegExpIterator } from "./regexp-iterator.js";
-import { nextRegExpIterator } from "./methods/regexp-iterator.js";
+import { nextObservableRegExpIterator, nextRegExpIterator } from "./methods/regexp-iterator.js";
 import { Budget, isFatalSandboxError } from "./budget.js";
 import { sandboxString } from "./string-coercion.js";
 import { awaitSandboxValue, awaitWithSignal } from "./cancel.js";
@@ -225,8 +225,11 @@ export function getSandboxIterator(value, budget, context) {
     }
     if (isSandboxCollectionIterator(value))
         return { next: () => nextCollectionIterator(value, budget), snapshotIndex: () => 0 };
-    if (isSandboxRegExpIterator(value))
+    if (isSandboxRegExpIterator(value)) {
+        if (context !== undefined && budget !== undefined)
+            return { asynchronous: true, next: () => nextObservableRegExpIterator(value, budget, context), snapshotIndex: () => 0 };
         return { next: () => nextRegExpIterator(value, budget), snapshotIndex: () => 0 };
+    }
     if (isGuestHostObject(value))
         return getHostObjectIterator(value);
     if (isFloat32Array(value)) {

package/packages/safe-js/dist/interp/methods/regex-split.d.ts

@@ -0,0 +1,3 @@
+import { type Budget } from "../budget.js";
+import { type SandboxCallContext, type SandboxClosure, type SandboxValue } from "../values.js";
+export declare function regexSplit(target: SandboxValue, input: SandboxValue, limit: SandboxValue, constructor: SandboxClosure, budget: Budget, context?: SandboxCallContext): Promise<SandboxValue[]>;

package/packages/safe-js/dist/interp/methods/regex-split.js

@@ -0,0 +1,102 @@
+import { isSandboxClosure } from "../values.js";
+import { getSandboxPropertyDescriptor } from "../object-model.js";
+import { readPropertyDescriptor } from "../accessors.js";
+import { invokeBuiltinClosure } from "../builtin-call.js";
+import { setSandboxProperty } from "../interpreter.js";
+import { sandboxNumber, sandboxString } from "../string-coercion.js";
+import { normalizeLastIndex } from "../regex/engine.js";
+import { retainValues } from "../resources.js";
+import { regexExec } from "./regex.js";
+export async function regexSplit(target, input, limit, constructor, budget, context) {
+    if (target === null || typeof target !== "object")
+        throw new TypeError("RegExp split requires an object receiver.");
+    let string;
+    let species;
+    let field;
+    let flags;
+    let matcher;
+    let match;
+    const result = [];
+    const release = retainValues(budget, () => [target, input, limit, string, species, field, flags, matcher, match, result]);
+    const read = (value, key) => {
+        if (context?.getProperty !== undefined)
+            return context.getProperty(value, key);
+        const descriptor = getSandboxPropertyDescriptor(value, key, budget);
+        return descriptor === undefined ? undefined : readPropertyDescriptor(descriptor, value, context);
+    };
+    const append = (value) => {
+        budget.allocateArrayLength(result.length + 1);
+        result.push(value);
+    };
+    try {
+        string = await sandboxString(input, budget, context);
+        input = undefined;
+        field = await read(target, "constructor");
+        species = constructor;
+        if (field !== undefined) {
+            if (field === null || typeof field !== "object")
+                throw new TypeError("Invalid RegExp species constructor.");
+            species = await read(field, Symbol.species);
+            if (species === null || species === undefined)
+                species = constructor;
+        }
+        field = undefined;
+        if (!isSandboxClosure(species) || species.construct === undefined)
+            throw new TypeError("RegExp species must be a constructor.");
+        field = await read(target, "flags");
+        flags = await sandboxString(field, budget, context);
+        field = undefined;
+        const unicode = flags.includes("u") || flags.includes("v");
+        if (!flags.includes("y"))
+            flags = budget.allocateString(flags + "y");
+        matcher = await invokeBuiltinClosure(species, [target, flags], budget, context, undefined, true);
+        const maximum = limit === undefined ? 2 ** 32 - 1 : (await sandboxNumber(limit, budget, context)) >>> 0;
+        limit = undefined;
+        if (maximum === 0)
+            return result;
+        if (string.length === 0) {
+            match = await regexExec(matcher, string, budget, context);
+            if (match === null)
+                append(string);
+            return result;
+        }
+        let end = 0;
+        let index = 0;
+        while (index < string.length) {
+            budget.visitNode();
+            match = undefined;
+            await setSandboxProperty(matcher, "lastIndex", index, budget, true, context);
+            match = await regexExec(matcher, string, budget, context);
+            if (match !== null) {
+                field = await read(matcher, "lastIndex");
+                const next = Math.min(normalizeLastIndex(await sandboxNumber(field, budget, context)), string.length);
+                field = undefined;
+                if (next !== end) {
+                    append(budget.allocateString(string.slice(end, index)));
+                    if (result.length === maximum)
+                        return result;
+                    end = next;
+                    field = await read(match, "length");
+                    const length = normalizeLastIndex(await sandboxNumber(field, budget, context));
+                    field = undefined;
+                    for (let capture = 1; capture < length; capture++) {
+                        budget.visitNode();
+                        field = await read(match, String(capture));
+                        append(field);
+                        field = undefined;
+                        if (result.length === maximum)
+                            return result;
+                    }
+                    index = end;
+                    continue;
+                }
+            }
+            index += unicode && (string.codePointAt(index) ?? 0) > 0xffff ? 2 : 1;
+        }
+        append(budget.allocateString(string.slice(end)));
+        return result;
+    }
+    finally {
+        release();
+    }
+}

package/packages/safe-js/dist/interp/methods/regex.d.ts

@@ -11,4 +11,4 @@ export declare function callRegexMethod(target: SandboxValue, methodName: RegexM
 export declare function regexExec(target: SandboxValue, input: string, budget: Budget, context?: SandboxCallContext): Promise<SandboxValue>;
 export declare function regexToString(target: SandboxValue, budget: Budget, context?: SandboxCallContext): Promise<string>;
 export declare function executeRegex(target: SandboxRegex, input: string, lastIndex: number): RegexMatch | null;
-export declare function toMatchArray(match: RegexMatch | null, input: string): SandboxValue;
+export declare function toMatchArray(match: RegexMatch | null, input: string, budget?: Budget): SandboxValue;

package/packages/safe-js/dist/interp/methods/regex.js

@@ -1,7 +1,7 @@
 import { createSandboxClosure, getSandboxRegexPattern, getRegexProperties, isSandboxClosure, isSandboxRegex } from "../values.js";
 import { matchRegex } from "../regex/engine.js";
 import { invokeBuiltinClosure } from "../builtin-call.js";
-import { getSandboxPropertyDescriptor, getSandboxPrototype, hasExplicitSandboxPrototype } from "../object-model.js";
+import { getSandboxPropertyDescriptor, getSandboxPrototype, hasExplicitSandboxPrototype, setSandboxPrototype } from "../object-model.js";
 import { readPropertyDescriptor } from "../accessors.js";
 import { retainValues } from "../resources.js";
 import { sandboxNumber, sandboxString } from "../string-coercion.js";
@@ -160,7 +160,7 @@ export async function callRegexMethod(target, methodName, args, budget, context)
         cursor = target.lastIndex;
         const lastIndex = await sandboxNumber(cursor, budget, context);
         const match = executeRegex(target, input, lastIndex);
-        return toMatchArray(match, input);
+        return toMatchArray(match, input, budget);
     }
     finally {
         budget.setRetainedValues(retained, undefined);
@@ -218,16 +218,27 @@ export async function regexToString(target, budget, context) {
 export function executeRegex(target, input, lastIndex) {
     const pattern = getSandboxRegexPattern(target);
     const match = matchRegex(pattern, input, lastIndex);
-    if (pattern.flags.global) {
+    if (pattern.flags.global || pattern.flags.sticky) {
         target.lastIndex = match === null ? 0 : match.index + match.text.length;
     }
     return match;
 }
-export function toMatchArray(match, input) {
+export function toMatchArray(match, input, budget) {
     if (match === null) {
         return null;
     }
+    budget?.allocateArrayLength(match.captures.length + 1);
     const result = [match.text, ...match.captures];
-    Object.assign(result, { index: match.index, input, groups: undefined });
+    if (match.groups !== undefined)
+        setSandboxPrototype(match.groups, null, budget);
+    if (match.indicesGroups !== undefined)
+        setSandboxPrototype(match.indicesGroups, null, budget);
+    Object.assign(result, { index: match.index, input, groups: match.groups });
+    if (match.indices !== undefined) {
+        budget?.allocateArrayLength(match.indices.length);
+        budget?.allocateArrayLength(2);
+        Object.assign(match.indices, { groups: match.indicesGroups });
+        Object.assign(result, { indices: match.indices });
+    }
     return result;
 }

package/packages/safe-js/dist/interp/methods/regexp-iterator.d.ts

@@ -1,8 +1,12 @@
 import type { Budget } from "../budget.js";
 import { type SandboxRegExpIterator } from "../regexp-iterator.js";
-import { type SandboxValue } from "../values.js";
+import { type SandboxCallContext, type SandboxValue } from "../values.js";
 export declare function nextRegExpIterator(iterator: SandboxRegExpIterator, budget?: Budget): {
     value: SandboxValue;
     done: boolean;
 };
+export declare function nextObservableRegExpIterator(iterator: SandboxRegExpIterator, budget: Budget, context: SandboxCallContext): Promise<{
+    value: SandboxValue;
+    done: boolean;
+}>;
 export declare function getRegExpIteratorMember(property: PropertyKey, budget: Budget): SandboxValue;

package/packages/safe-js/dist/interp/methods/regexp-iterator.js

@@ -1,15 +1,23 @@
 import { isSandboxRegExpIterator, regexpIteratorState } from "../regexp-iterator.js";
-import { createSandboxClosure } from "../values.js";
-import { executeRegex, toMatchArray } from "./regex.js";
+import { createSandboxClosure, isSandboxRegex } from "../values.js";
+import { executeRegex, regexExec, toMatchArray } from "./regex.js";
+import { getSandboxPropertyDescriptor, hasRegexPropertyOverride } from "../object-model.js";
+import { readPropertyDescriptor } from "../accessors.js";
+import { setSandboxProperty } from "../interpreter.js";
+import { sandboxNumber, sandboxString } from "../string-coercion.js";
+import { normalizeLastIndex } from "../regex/engine.js";
+import { retainValues } from "../resources.js";
 export function nextRegExpIterator(iterator, budget) {
     const state = regexpIteratorState(iterator);
     budget?.visitNode();
     if (state.exhausted)
         return { value: undefined, done: true };
     const matcher = state.matcher;
+    if (!isSandboxRegex(matcher))
+        throw new TypeError("Custom RegExp iterator execution requires a sandbox context.");
     const input = state.input;
     const match = executeRegex(matcher, input, Number(matcher.lastIndex));
-    if (match === null || !matcher.flags.includes("g")) {
+    if (match === null || !(state.global ?? matcher.flags.includes("g"))) {
         state.exhausted = true;
         state.matcher = undefined;
         state.input = undefined;
@@ -18,12 +26,56 @@ export function nextRegExpIterator(iterator, budget) {
         return { value: undefined, done: true };
     if (!state.exhausted && match.text.length === 0) {
         const index = Number(matcher.lastIndex);
-        const unicode = matcher.flags.includes("u") || matcher.flags.includes("v");
+        const unicode = state.unicode ?? (matcher.flags.includes("u") || matcher.flags.includes("v"));
         const codePoint = input.codePointAt(index);
         matcher.lastIndex = index + (unicode && codePoint !== undefined && codePoint > 0xffff ? 2 : 1);
     }
-    budget?.allocateArrayLength(match.captures.length + 1);
-    return { value: toMatchArray(match, input), done: false };
+    return { value: toMatchArray(match, input, budget), done: false };
+}
+export async function nextObservableRegExpIterator(iterator, budget, context) {
+    const state = regexpIteratorState(iterator);
+    if (state.exhausted)
+        return { value: undefined, done: true };
+    const matcher = state.matcher;
+    if (isSandboxRegex(matcher) && !hasRegexPropertyOverride(matcher, ["exec"], budget) &&
+        (matcher.lastIndex === null || typeof matcher.lastIndex !== "object"))
+        return nextRegExpIterator(iterator, budget);
+    const input = state.input;
+    let result;
+    let field;
+    const release = retainValues(budget, () => [iterator, matcher, input, result, field]);
+    const read = (value, key) => {
+        if (context.getProperty !== undefined)
+            return context.getProperty(value, key);
+        const descriptor = getSandboxPropertyDescriptor(value, key, budget);
+        return descriptor === undefined ? undefined : readPropertyDescriptor(descriptor, value, context);
+    };
+    try {
+        budget.visitNode();
+        result = await regexExec(matcher, input, budget, context);
+        const global = state.global ?? (isSandboxRegex(matcher) && matcher.flags.includes("g"));
+        if (result === null || !global) {
+            state.exhausted = true;
+            state.matcher = undefined;
+            state.input = undefined;
+            return result === null ? { value: undefined, done: true } : { value: result, done: false };
+        }
+        field = await read(result, "0");
+        const text = await sandboxString(field, budget, context);
+        field = undefined;
+        if (text.length === 0) {
+            field = await read(matcher, "lastIndex");
+            const index = normalizeLastIndex(await sandboxNumber(field, budget, context));
+            field = undefined;
+            const unicode = state.unicode ?? (isSandboxRegex(matcher) && (matcher.flags.includes("u") || matcher.flags.includes("v")));
+            const point = input.codePointAt(index);
+            await setSandboxProperty(matcher, "lastIndex", index + (unicode && point !== undefined && point > 0xffff ? 2 : 1), budget, true, context);
+        }
+        return { value: result, done: false };
+    }
+    finally {
+        release();
+    }
 }
 export function getRegExpIteratorMember(property, budget) {
     if (property === Symbol.toStringTag)
@@ -43,7 +95,7 @@ export function getRegExpIteratorMember(property, budget) {
             const receiver = context?.thisValue;
             if (!isSandboxRegExpIterator(receiver))
                 throw new TypeError("RegExp string iterator next requires a matching receiver.");
-            return nextRegExpIterator(receiver, budget);
+            return context === undefined ? nextRegExpIterator(receiver, budget) : nextObservableRegExpIterator(receiver, budget, context);
         }
     });
 }

package/packages/safe-js/dist/interp/methods/string.js

@@ -1,14 +1,14 @@
 import { types } from "node:util";
 import { invokeBuiltinClosure } from "../builtin-call.js";
 import { CompileScope } from "../regex/compile-guard.js";
-import { normalizeLastIndex } from "../regex/engine.js";
+import { advanceStringIndex, normalizeLastIndex } from "../regex/engine.js";
 import { sandboxNumber, sandboxString } from "../string-coercion.js";
 import { retainValues } from "../resources.js";
 import { getSandboxDataProperty, getSandboxPropertyDescriptor, hasRegexPropertyOverride } from "../object-model.js";
 import { readPropertyDescriptor } from "../accessors.js";
 import { createSandboxBox } from "../boxed.js";
 import { setSandboxProperty } from "../interpreter.js";
-import { createSandboxClosure, createSandboxRegex, deepCopyFromSandbox, isSandboxClosure, isSandboxRegex, measureSandboxData } from "../values.js";
+import { createSandboxClosure, createSandboxRegex, deepCopyFromSandbox, getSandboxRegexPattern, isSandboxClosure, isSandboxRegex, measureSandboxData } from "../values.js";
 import { executeRegex, getRegexMember, regexExec, regexFlagProperties, regexSearch, toMatchArray } from "./regex.js";
 import { restoreSandboxRegExpIterator } from "../regexp-iterator.js";
 export const stringMethodNames = new Set([
@@ -356,7 +356,7 @@ function callReplaceLikeMethod(value, methodName, args, budget, callClosure, use
     return replaceWithClosure(value, search, replacement, methodName === "replaceAll", budget, callClosure, context);
 }
 async function replaceRegex(value, regex, replacement, budget, callClosure, context) {
-    if (hasRegexPropertyOverride(regex, ["exec", "flags", ...Object.keys(regexFlagProperties)], budget))
+    if (getSandboxRegexPattern(regex).groups !== undefined || hasRegexPropertyOverride(regex, ["exec", "flags", ...Object.keys(regexFlagProperties)], budget))
         return regexReplace(value, regex, replacement, budget, callClosure, context);
     if (regex.flags.includes("g"))
         regex.lastIndex = 0;
@@ -410,7 +410,7 @@ export async function regexReplace(input, regex, replacementInput, budget, callC
         input = undefined;
         replacement = isSandboxClosure(replacementInput) ? replacementInput : await sandboxString(replacementInput, budget, context);
         replacementInput = undefined;
-        if (isSandboxRegex(regex) && !hasRegexPropertyOverride(regex, ["exec", "flags", ...Object.keys(regexFlagProperties)], budget)) {
+        if (isSandboxRegex(regex) && getSandboxRegexPattern(regex).groups === undefined && !hasRegexPropertyOverride(regex, ["exec", "flags", ...Object.keys(regexFlagProperties)], budget)) {
             release();
             return await replaceRegex(value, regex, replacement, budget, callClosure, context);
         }
@@ -641,7 +641,7 @@ function splitNormalized(value, separator, limit, budget, parent) {
                 if (match === null)
                     break;
                 if (match.text.length === 0)
-                    splitter.lastIndex = match.index + 1;
+                    splitter.lastIndex = advanceStringIndex(value, match.index, splitter.flags.includes("u") || splitter.flags.includes("v"));
                 endedWithZeroWidthMatch = match.text.length === 0 && match.index === value.length;
                 if (match.text.length === 0 &&
                     (match.index === copiedThrough || match.index === value.length))
@@ -822,7 +822,7 @@ function callMatchLikeMethod(value, methodName, args, compilation, lastIndex) {
         return match?.index ?? -1;
     }
     if (methodName === "match" && !regex.flags.includes("g"))
-        return toMatchArray(executeRegex(regex, value, lastIndex ?? Number(regex.lastIndex)), value);
+        return toMatchArray(executeRegex(regex, value, lastIndex ?? Number(regex.lastIndex)), value, compilation.owner?.budget);
     if (methodName === "match")
         regex.lastIndex = 0;
     const matcher = methodName === "matchAll"
@@ -843,7 +843,7 @@ function collectRegexMatches(regex, value, all, budget, lastIndex = 0) {
         matches.push(match);
         lastIndex = match.index + match.text.length;
         if (all && match.text.length === 0)
-            regex.lastIndex = ++lastIndex;
+            regex.lastIndex = lastIndex = advanceStringIndex(value, lastIndex, regex.flags.includes("u") || regex.flags.includes("v"));
     } while (all);
     return matches;
 }

package/packages/safe-js/dist/interp/object-model.d.ts

@@ -16,6 +16,7 @@ export declare function isIntrinsicConstructor(value: object): boolean;
 export declare function releaseObjectPrototype(budget: Budget): void;
 export declare function getSandboxPrototype(value: object, budget?: Budget): object | null;
 export declare function hasExplicitSandboxPrototype(value: object): boolean;
+export declare function hasNullObjectPrototype(value: object): boolean;
 export declare function getSandboxPropertyDescriptor(value: SandboxValue, key: PropertyKey, budget?: Budget): PropertyDescriptor | undefined;
 export declare function getSandboxDataProperty(value: SandboxValue, key: PropertyKey, budget?: Budget): SandboxValue;
 export declare function setSandboxPrototype(value: object, prototype: object | null, budget?: Budget): void;

package/packages/safe-js/dist/interp/object-model.js

@@ -180,6 +180,9 @@ export function getSandboxPrototype(value, budget) {
 export function hasExplicitSandboxPrototype(value) {
     return prototypes.has(value);
 }
+export function hasNullObjectPrototype(value) {
+    return prototypes.get(value) === null && !Array.isArray(value) && !isSandboxClosure(value) && !isSandboxRegex(value);
+}
 export function getSandboxPropertyDescriptor(value, key, budget) {
     const hostProperties = isSandboxClosure(value) ? value.properties : undefined;
     if (isSandboxClosure(value) && !isGuestClosure(value))
@@ -288,7 +291,7 @@ export function hasGuestObjectState(value) {
         return !intrinsicUnchanged();
     if (isLiveCapability(value))
         return true;
-    if (functionProperties.has(value) || prototypes.has(value))
+    if (functionProperties.has(value) || (prototypes.has(value) && !hasNullObjectPrototype(value)))
         return true;
     if (isSandboxBox(value) || isSandboxDate(value))
         return false;

package/packages/safe-js/dist/interp/regex/compile-guard.js

@@ -121,7 +121,7 @@ export class RegexCompileGuard {
         this.work(flags.length);
     }
     retain(pattern, valueUnits = 0) {
-        const units = 10 + pattern.source.length + measureNode(pattern.body);
+        const units = measurePattern(pattern);
         if (this.ticket !== undefined) {
             this.ticket.owner.budget.resizeCompileTicket(this.ticket, units + valueUnits);
         }
@@ -139,7 +139,16 @@ export class RegexCompileGuard {
     }
 }
 export function regexCompiledData(pattern) {
-    return (compiledData.get(pattern) ?? { units: 10 + pattern.source.length + measureNode(pattern.body) });
+    return (compiledData.get(pattern) ?? { units: measurePattern(pattern) });
+}
+function measurePattern(pattern) {
+    let units = 10 + pattern.source.length + measureNode(pattern.body);
+    if (pattern.groups !== undefined) {
+        units += 1;
+        for (const [name, indices] of Object.entries(pattern.groups))
+            units += name.length + 2 + indices.length;
+    }
+    return units;
 }
 function measureNode(node) {
     switch (node.type) {
@@ -148,18 +157,27 @@ function measureNode(node) {
             return 2;
         case "literal":
             return 3 + node.value.length;
+        case "namedBackreference":
+            return 3 + node.name.length;
         case "anchor":
         case "wordBoundary":
+        case "backreference":
             return 3;
         case "characterClass": {
             let usage = 5 + node.items.length;
+            if (node.operation !== undefined)
+                usage += 1 + node.operation.length;
+            if (node.strings !== undefined)
+                usage += 1;
             for (const item of node.items) {
                 usage +=
                     item.type === "character"
                         ? 3 + item.value.length
                         : item.type === "range"
                             ? 4 + item.from.length + item.to.length
-                            : 4;
+                            : item.type === "property" ? 4 + item.value.length + (item.strings === undefined ? 0 : 1)
+                                : item.type === "set" ? 3 + measureNode({ type: "characterClass", ...item.value })
+                                    : item.type === "strings" ? 4 + item.values.reduce((total, value) => total + 1 + value.length, 0) : 4;
             }
             return usage;
         }
@@ -172,7 +190,11 @@ function measureNode(node) {
             return usage;
         }
         case "group":
-            return 5 + measureNode(node.body);
+            return 5 + measureNode(node.body) + (node.name === undefined ? 0 : 1 + node.name.length) +
+                (node.modifiers === undefined ? 0 : 2 + Object.keys(node.modifiers).length);
+        case "lookahead":
+        case "lookbehind":
+            return 4 + measureNode(node.body);
         case "quantifier":
             return (Object.hasOwn(node, "max") ? 6 : 5) + measureNode(node.body);
     }