Skip to content

fix(frontend): no regex literal ends in an escaped slash - #2057

Merged
rpgmem merged 1 commit into
developfrom
claude/minifier-safe-regex
Oct 24, 2026
Merged

rpgmem merged 1 commit into
developfrom
claude/minifier-safe-regex

Conversation

@rpgmem

@rpgmem rpgmem commented Oct 24, 2026

Copy link
Copy Markdown
Owner

Closes #2056

Problem

On the testing site, /valid/?ffc_device_check=1 stays at "Checking…" on every row for visitors who are not logged in, on phones and on desktop. A logged-in administrator sees it work.

LiteSpeed Cache minifies and combines scripts for guests through matthiasmullie/minify. That minifier misreads a regex literal that ends in an escaped slash when it is followed by ] or a line break: it closes the literal early and drops the rest of the line. The combined file on the site has ['LINE',/Line\];var BRANDS=…, from ['LINE', /Line\//] (#2053). The file stops parsing ("Invalid regular expression: missing /"), so no script in it runs.

Change

  • The three literals of that shape now end in \/\d or \/{2}:

    • ffc-device-check.js;
    • ffc-core.js (the in-app browser check);
    • ffc-preflight.js (the Android "open in Chrome" link).

    The last two survive the minifier today only because of the character that follows them.

  • MinifierSafeRegexTest refuses a regex literal ending in an escaped slash in assets/js/. The rule is wider than the measured trigger on purpose: which characters may follow the literal safely is the minifier's business.

Tests

  • Reproduced locally with matthiasmullie/minify: the same output as the site's combined file.
  • After the fix, every readable script (assets/js/*.js and libs/js/*.js, 118 files) and every *.min.js (114) goes through that minifier and still parses (node --check).
  • MinifierSafeRegexTest:
    • fails with the three files listed when the JS change is reverted, and passes with it;
    • its canary pins both sides;
    • a scandir recount checks that it reads every script.
  • Full Vitest run: 164 files, 2,557 tests. The in-app UA corpus (Line/14.13.0) still detects LINE.
  • ESLint and PHPCS (tests ruleset) are clean.

Checklist

  • Base is develop; no version bump
  • CHANGELOG.md — one bullet at the end of Fixed, citing the issue
  • Documentation topic — not applicable
  • Strings — none changed
  • Minified assets rebuilt
  • Fast checks run locally

Generated by Claude Code

LiteSpeed Cache minifies and combines scripts for guests through
matthiasmullie/minify. That minifier reads a regex literal ending in an
escaped slash, followed by `]` or a line break, as closing early and
drops the rest of the line. `['LINE', /Line\//]` (#2053) came out as
`['LINE',/Line\];`, the combined file stopped parsing, and the device
test stayed at "Checking…" for every visitor who is not logged in.

The three such literals become `\/\d` and `\/{2}`. Every readable and
minified script in assets/js and libs/js was run through the same
minifier and still parses. MinifierSafeRegexTest refuses the shape,
with a canary and an independent recount of the scanned files.

Closes #2056

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018srx5hc431EYmG4MHUr2KA
@rpgmem rpgmem added bug Something isn't working area:certificates labels Oct 24, 2026 — with Claude
@rpgmem
rpgmem marked this pull request as ready for review October 24, 2026 12:50
@rpgmem
rpgmem enabled auto-merge (squash) October 24, 2026 12:50
@rpgmem
rpgmem merged commit 0658079 into develop Oct 24, 2026
21 checks passed
@rpgmem
rpgmem deleted the claude/minifier-safe-regex branch October 24, 2026 13:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:certificates bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants