StringIndexOutOfBounds thrown for malformed escape sequences #62

Author: aeberhart

src/main/java/com/dashjoin/jsonata/Tokenizer.java

@@ -263,12 +263,12 @@ Token next(boolean prefix) {
                 currentChar = path.charAt(position);
                 if (currentChar == '\\') { // escape sequence
                     position++;
-                    currentChar = path.charAt(position);
+                    if (position < path.length()) currentChar = path.charAt(position); else throw new JException("S0103", position, "");
                     if (escapes.get(""+currentChar)!=null) {
                         qstr += escapes.get(""+currentChar);
                     } else if (currentChar == 'u') {
                         //  u should be followed by 4 hex digits
-                        String octets = path.substring(position + 1, (position + 1) + 4);
+                        String octets = position+5 < path.length() ? path.substring(position + 1, (position + 1) + 4) : "";
                         if (octets.matches("^[0-9a-fA-F]+$")) { //  /^[0-9a-fA-F]+$/.test(octets)) {
                             int codepoint = Integer.parseInt(octets, 16);
                             qstr += Character.toString((char) codepoint);
@@ -278,7 +278,7 @@ Token next(boolean prefix) {
                         }
                     } else {
                         // illegal escape sequence
-                        throw new JException("S0301", position, currentChar);
+                        throw new JException("S0103", position, currentChar);
 
                     }
                 } else if (currentChar == quoteType) {

src/test/java/com/dashjoin/jsonata/ParserTest.java

@@ -0,0 +1,18 @@
+package com.dashjoin.jsonata;
+
+import static com.dashjoin.jsonata.Jsonata.jsonata;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+
+public class ParserTest {
+
+  @Test
+  public void testUnsupportedEscapeSequence() {
+    Assertions.assertThrows(JException.class, ()->jsonata("$substring('input', '\\a"));
+    Assertions.assertThrows(JException.class, ()->jsonata("$substring('input', '\\"));
+    Assertions.assertEquals("", jsonata("$substring('\\\\', 1)").evaluate(null));
+    
+    Assertions.assertThrows(JException.class, ()->jsonata("$substring('\\u"));
+    Assertions.assertEquals("", jsonata("$substring('\\uDDDD', 1)").evaluate(null));
+  }
+}