Repository: jerryscript-project/jerryscript
File: jerry-core/ecma/builtin-objects/ecma-builtin-global.c (C)

Code before:
ecma_builtin_global_object_unescape (lit_utf8_byte_t *input_start_p, /**< routine's first argument's
                                                                      *   string buffer */
                                     lit_utf8_size_t input_size) /**< routine's first argument's
                                                                  *   string buffer's size */
{
  if (input_size == 0)
  {
    return ecma_make_magic_string_value (LIT_MAGIC_STRING__EMPTY);
  }

  const lit_utf8_byte_t *input_curr_p = input_start_p;
  const lit_utf8_byte_t *input_end_p = input_start_p + input_size;
  ecma_stringbuilder_t builder = ecma_stringbuilder_create ();

  while (input_curr_p < input_end_p)
  {
    ecma_char_t chr = lit_cesu8_read_next (&input_curr_p);
    lit_utf8_size_t byte_offset = (lit_utf8_size_t) (input_end_p - input_curr_p);

    // potential pattern
    if (chr == LIT_CHAR_PERCENT)
    {
      // potential unicode sequence
      if (byte_offset >= 5 && input_curr_p[0] == LIT_CHAR_LOWERCASE_U)
      {
        ecma_builtin_global_object_unescape_helper (&input_curr_p, &chr, 5, true);
      }
      // potential two hexa sequence
      else if (byte_offset >= 2)
      {
        ecma_builtin_global_object_unescape_helper (&input_curr_p, &chr, 2, false);
      }
    }

    ecma_stringbuilder_append_char (&builder, chr);
  }

  return ecma_make_string_value (ecma_stringbuilder_finalize (&builder));
} /* ecma_builtin_global_object_unescape */

#endif /* ENABLED (JERRY_BUILTIN_ANNEXB) */

/**
 * Dispatcher of the built-in's routines
 *
 * @return ecma value
 *         Returned value must be freed with ecma_free_value.
 */
ecma_value_t
ecma_builtin_global_dispatch_routine (uint16_t builtin_routine_id, /**< built-in wide routine identifier */
                                      ecma_value_t this_arg, /**< 'this' argument value */

Review comment (security):
Why don't we increment `input_curr_p` before calling the unescape helper, the there's no need for the `unicode_sequence` argument.

Code after:
 */
static ecma_value_t
ecma_builtin_global_object_unescape (lit_utf8_byte_t *input_start_p, /**< routine's first argument's
                                                                      *   string buffer */
                                     lit_utf8_size_t input_size) /**< routine's first argument's
                                                                  *   string buffer's size */
{
  if (input_size == 0)
  {
    return ecma_make_magic_string_value (LIT_MAGIC_STRING__EMPTY);
  }

  const lit_utf8_byte_t *input_curr_p = input_start_p;
  const lit_utf8_byte_t *input_end_p = input_start_p + input_size;
  ecma_stringbuilder_t builder = ecma_stringbuilder_create ();

  while (input_curr_p < input_end_p)
  {
    ecma_char_t chr = lit_cesu8_read_next (&input_curr_p);

    // potential pattern
    if (chr == LIT_CHAR_PERCENT)
    {
      const lit_utf8_size_t chars_leftover = (lit_utf8_size_t) (input_end_p - input_curr_p);

      // potential unicode sequence
      if (chars_leftover >= 5 && input_curr_p[0] == LIT_CHAR_LOWERCASE_U)
      {
        input_curr_p += ecma_builtin_global_object_unescape_resolve_escape (input_curr_p, true, &chr);
      }
      // potential two hexa sequence
      else if (chars_leftover >= 2)
      {
        input_curr_p += ecma_builtin_global_object_unescape_resolve_escape (input_curr_p, false, &chr);
      }
    }

    ecma_stringbuilder_append_char (&builder, chr);
  }

  return ecma_make_string_value (ecma_stringbuilder_finalize (&builder));
} /* ecma_builtin_global_object_unescape */

#endif /* ENABLED (JERRY_BUILTIN_ANNEXB) */

/**
 * Dispatcher of the built-in's routines
 *
 * @return ecma value
 *         Returned value must be freed with ecma_free_value.
 */