René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Medium][view] Compiler emits ok:true for unterminated/invalid literals → poisons whole compiled module","articleBody":"## Severity: 🟡 Medium (correctness — build-breaking)\n\n## Location\n[`src/view/compiler/expression.ts:120-128`](../blob/main/src/view/compiler/expression.ts#L120-L128) (`scanStringLiteral`), surfaced at `:380-386`; emitted at [`src/view/compiler/emit.ts:35`](../blob/main/src/view/compiler/emit.ts#L35).\n\n## Description\n`scanStringLiteral` returns `i + 1` unconditionally and never verifies the closing quote was found:\n```ts\nconst scanStringLiteral = (src, start) =\u003e {\n  const quote = src[start];\n  let i = start + 1;\n  while (i \u003c src.length \u0026\u0026 src[i] !== quote) {\n    if (src[i] === '\\\\') i += 1;\n    i += 1;\n  }\n  return i + 1;   // returns past end-of-input if quote never closed\n};\n```\nAn unterminated string literal in a directive expression is therefore copied verbatim and `rewrite` returns normally, so `compileExpression` reports `{ ok: true, code }` with a syntactically broken body. Because `emitModule` writes every expression into **one** module, a single malformed expression throws at import time and takes down **all** precompiled expressions in that file — and unlike the runtime path, there is no per-expression `try/catch` fallback.\n\nRepro: template `\u003cp bq-text=\"'oops\"\u003e\u003c/p\u003e` compiles to:\n```js\nregisterCompiledExpressions({\n  \"'oops\": (__bq_ctx) =\u003e ('oops),   // SyntaxError → whole module fails to import\n});\n```\nThe same class of bug produces invalid emitted code for malformed numeric literals (e.g. `1ex`), since `scanNumericLiteral` (`:135-153`) will also happily consume an invalid run.\n\n## Suggested fix\nIn `scanStringLiteral`, detect reaching end-of-input without the matching quote and `throw new Bail('unterminated string literal')` so the build falls back to the runtime evaluator for that expression. Add a post-scan validity check for numeric literals, or wrap emitted expressions so one bad entry cannot break the whole module.\n\n---\n_Filed as part of a full-codebase security \u0026 correctness audit._\n","author":{"url":"https://github.com/JosunLP","@type":"Person","name":"JosunLP"},"datePublished":"2026-07-05T17:03:15.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/170/bQuery/issues/170"}