From 733a70671b989c5ffd276a00f18f810ad1714ee4 Mon Sep 17 00:00:00 2001
From: davidot <davidot@serenityos.org>
Date: Sun, 19 Dec 2021 02:31:21 +0100
Subject: [PATCH] LibRegex: Disallow duplicate named capture groups in ECMA262
 parser

---
 Tests/LibRegex/Regex.cpp                    | 2 ++
 Userland/Libraries/LibC/regex.h             | 1 +
 Userland/Libraries/LibRegex/RegexError.h    | 3 +++
 Userland/Libraries/LibRegex/RegexParser.cpp | 5 +++++
 4 files changed, 11 insertions(+)

diff --git a/Tests/LibRegex/Regex.cpp b/Tests/LibRegex/Regex.cpp
index 5f87ebff7a..1716462c06 100644
--- a/Tests/LibRegex/Regex.cpp
+++ b/Tests/LibRegex/Regex.cpp
@@ -591,6 +591,8 @@ TEST_CASE(ECMA262_parse)
         { "a{9007199254740991,9007199254740992}"sv, regex::Error::InvalidBraceContent },
         { "a{9007199254740992,9007199254740991}"sv, regex::Error::InvalidBraceContent },
         { "a{9007199254740992,9007199254740992}"sv, regex::Error::InvalidBraceContent },
+        { "(?<a>a)(?<a>b)"sv, regex::Error::DuplicateNamedCapture },
+        { "(?<a>a)(?<b>b)(?<a>c)"sv, regex::Error::DuplicateNamedCapture },
     };
 
     for (auto& test : tests) {
diff --git a/Userland/Libraries/LibC/regex.h b/Userland/Libraries/LibC/regex.h
index 679db8671f..3697286de6 100644
--- a/Userland/Libraries/LibC/regex.h
+++ b/Userland/Libraries/LibC/regex.h
@@ -38,6 +38,7 @@ enum __Regex_Error {
     __Regex_InvalidCaptureGroup,        // Content of capture group is invalid.
     __Regex_InvalidNameForCaptureGroup, // Name of capture group is invalid.
     __Regex_InvalidNameForProperty,     // Name of property is invalid.
+    __Regex_DuplicateNamedCapture,      // Duplicate named capture group
 };
 
 enum ReError {
diff --git a/Userland/Libraries/LibRegex/RegexError.h b/Userland/Libraries/LibRegex/RegexError.h
index 5a4428c93f..33dc11ae9f 100644
--- a/Userland/Libraries/LibRegex/RegexError.h
+++ b/Userland/Libraries/LibRegex/RegexError.h
@@ -35,6 +35,7 @@ enum class Error : u8 {
     InvalidCaptureGroup = __Regex_InvalidCaptureGroup,               // Content of capture group is invalid.
     InvalidNameForCaptureGroup = __Regex_InvalidNameForCaptureGroup, // Name of capture group is invalid.
     InvalidNameForProperty = __Regex_InvalidNameForProperty,         // Name of property is invalid.
+    DuplicateNamedCapture = __Regex_DuplicateNamedCapture,           // Name of property is invalid.
 };
 
 inline String get_error_string(Error error)
@@ -76,6 +77,8 @@ inline String get_error_string(Error error)
         return "Name of capture group is invalid.";
     case Error::InvalidNameForProperty:
         return "Name of property is invalid.";
+    case Error::DuplicateNamedCapture:
+        return "Duplicate capture group name";
     }
     return "Undefined error.";
 }
diff --git a/Userland/Libraries/LibRegex/RegexParser.cpp b/Userland/Libraries/LibRegex/RegexParser.cpp
index 91c42e5173..3642c93b48 100644
--- a/Userland/Libraries/LibRegex/RegexParser.cpp
+++ b/Userland/Libraries/LibRegex/RegexParser.cpp
@@ -2166,6 +2166,11 @@ bool ECMA262Parser::parse_capture_group(ByteCode& stack, size_t& match_length_mi
                 return false;
             }
 
+            if (m_parser_state.named_capture_groups.contains(name)) {
+                set_error(Error::DuplicateNamedCapture);
+                return false;
+            }
+
             ByteCode capture_group_bytecode;
             size_t length = 0;
             enter_capture_group_scope();