René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"util.stripVTControlCharacters() fails to strip OSC 8 hyperlinks whose URI contains characters like \"(\"","articleBody":"### Version\n\nv22.22.3 (also reproduces on `main`)\n\n### Platform\n\nAny (logic bug in a bundled regex, not platform-specific)\n\n### Subsystem\n\nutil\n\n### What steps will reproduce the bug?\n\n```js\nimport {stripVTControlCharacters} from 'node:util';\n\n// OSC 8 hyperlink whose URI contains `(`, a character RFC 3986 allows unencoded.\nconst link = '\\u001B]8;;https://example.com/(foo\\u0007label\\u001B]8;;\\u0007';\n\nconsole.log(stripVTControlCharacters(link));\n```\n\n### How often does it reproduce? Is there a required condition?\n\nAlways, whenever an OSC 8 hyperlink URI contains one of: `!`, `$`, `'`, `(`, `)`, `*`, `+`, `,`, `[`, `]`.\n\n### What is the expected behavior? Why is that the expected behavior?\n\nThe visible label with all escape sequences removed:\n\n```\nlabel\n```\n\n### What do you see instead?\n\nThe hyperlink is not stripped and most of the URI (plus the BEL terminator) leaks into the output. The returned string is:\n\n```\n'ttps://example.com/(foo\\u0007label'\n```\n\n### Additional information\n\n`stripVTControlCharacters()` uses a bundled copy of [`chalk/ansi-regex`](https://github.com/chalk/ansi-regex) in `lib/internal/util/inspect.js`, pinned to ansi-regex [`f338e18`](https://github.com/chalk/ansi-regex/blob/f338e1814144efb950276aac84135ff86b72dc8e/index.js) (v6.1.0). That version matches OSC parameter/URI bytes with the restricted class `[-a-zA-Z\\d/#&.:=?%@~_]`, which omits ten characters RFC 3986 permits unencoded in a URI: `!`, `$`, `'`, `(`, `)`, `*`, `+`, `,`, `[`, `]`. When the URI contains any of them, the OSC branch never reaches the string terminator, so the sequence is left largely intact.\n\nansi-regex fixed this in v6.2.0 ([`72bc570`](https://github.com/chalk/ansi-regex/commit/72bc570aaf25fca25541b49c6a8564f3ec63e835)) by matching OSC sequences generically as `ESC ] … ST` (non-greedy up to the first string terminator) instead of enumerating allowed URI bytes. Syncing the bundled regex to ansi-regex >=6.2.0 resolves it.","author":{"url":"https://github.com/sindresorhus","@type":"Person","name":"sindresorhus"},"datePublished":"2026-07-06T00:00:52Z","url":"https://github.com/nodejs/node/issues/64313"}