Escape untrusted JavaScript literals

[logbie]

Summary

• route untrusted transpiler strings through one JavaScript string-literal encoder
• apply the encoder to headers, time formats, event/signal names, container metadata, test descriptions, type assertions, map keys, and ordinary string literals
• escape regex-literal delimiters and JavaScript line separators in pattern text
• add adversarial header/time-format regressions and direct encoder tests
• fix test descriptions so they are emitted as actual JavaScript strings

Security impact

Several AST string fields were interpolated directly into single-quoted generated JavaScript. A crafted, valid WFL source file could close those literals and inject JavaScript into transpiler output. Generated strings now use a centralized quoted encoder that escapes code boundaries, control characters, and line separators.

Validation

• git diff --check
• node --check against representative generated header, time-format, and regex fragments
• focused Rust regressions added for the vulnerable sinks and escaping helpers
• Rust tests were not run locally because this workspace has no Rust toolchain; repository CI passed on the final head
• all GitHub CI, config lint, and review checks passed on the final head

Production readiness

• area: Security / Correctness / Testing
• advances the transpiler source-safety gate tracked in WFL Production Readiness: 8/10 by January 1, 2027 #610
• compatibility impact: generated JavaScript consistently uses double-quoted literals; string values are unchanged

[coderabbitai]

Warning

Review limit reached

@logbie, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 59 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 0edeb497-6f41-428a-bd3d-0a81937e9df5

📥 Commits

Reviewing files that changed from the base of the PR and between 0f52b3a and 1c62421.

📒 Files selected for processing (2)

• src/transpiler/javascript.rs
• tests/transpiler_test.rs

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/escape-javascript-literals

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[Copilot]

Pull request overview

This PR hardens the JavaScript transpiler against code-injection by routing untrusted AST string values through a centralized JavaScript string-literal encoder and by escaping regex-literal delimiters/line separators in pattern text, with targeted regressions to prevent reintroducing vulnerable sinks.

Changes:

• Centralizes JS string emission via js_string_literal(...) and applies it to multiple previously-interpolated string fields (headers, time formats, describe/test descriptions, type assertions, container metadata, map keys, and ordinary string literals).
• Strengthens regex_escape(...) to prevent closing out generated regex literals and to handle JS line separators safely.
• Adds regression tests for adversarial header names/time formats and verifies describe/test descriptions are emitted as valid JS string literals.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/transpiler/javascript.rs	Introduces js_string_literal and expands regex_escape to prevent JS literal/regex breakouts; updates transpiler emission sites to use the centralized encoder.
tests/transpiler_test.rs	Adds regressions ensuring untrusted header/time-format strings can’t escape generated JS and that describe/test descriptions are emitted as JS strings.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[logbie]

Superseded by #632, which preserves this security fix in the consolidated Rust-source hardening PR. The combined head is mergeable and all required CI checks are green.