[JsonPath] Better handling of Unicode chars in expressions

alexandre-daubois · alexandre-daubois · commit 54e35eb41b34 · 2025-06-04T10:26:32.000+02:00
diff --git a/src/Symfony/Component/JsonPath/JsonCrawler.php b/src/Symfony/Component/JsonPath/JsonCrawler.php
@@ -230,14 +230,29 @@ private function evaluateBracket(string $expr, mixed $value): array
 
         // quoted strings for object keys
         if (preg_match('/^([\'"])(.*)\1$/', $expr, $matches)) {
-            $key = stripslashes($matches[2]);
+            $key = $this->unescapeString($matches[2], $matches[1]);
 
             return \array_key_exists($key, $value) ? [$value[$key]] : [];
         }
 
         throw new \LogicException(\sprintf('Unsupported bracket expression "%s".', $expr));
     }
 
+    private function unescapeString(string $str, string $quoteChar): string
+    {
+        if ('"' === $quoteChar) {
+            // try JSON decoding first for unicode sequences
+            $jsonStr = '"' . $str . '"';
+            $decoded = json_decode($jsonStr, true);
+
+            if (null !== $decoded) {
+                return $decoded;
+            }
+        }
+
+        return JsonPathUtils::unescapeString($str);
+    }
+
     private function evaluateFilter(string $expr, mixed $value): array
     {
         if (!\is_array($value)) {
@@ -335,7 +350,7 @@ private function evaluateScalar(string $expr, array $context): mixed
 
         // string literals
         if (preg_match('/^([\'"])(.*)\1$/', $expr, $matches)) {
-            return $matches[2];
+            return $this->unescapeString($matches[2], $matches[1]);
         }
 
         // current node references
diff --git a/src/Symfony/Component/JsonPath/JsonPathUtils.php b/src/Symfony/Component/JsonPath/JsonPathUtils.php
@@ -85,4 +85,96 @@ public static function findSmallestDeserializableStringAndPath(array $tokens, mi
             'tokens' => $remainingTokens,
         ];
     }
+
+    public static function unescapeString(string $str): string
+    {
+        $result = '';
+        $length = strlen($str);
+
+        for ($i = 0; $i < $length; $i++) {
+            if ('\\' === $str[$i] && $i + 1 < $length) {
+                $nextChar = $str[$i + 1];
+
+                switch ($nextChar) {
+                    case '"':
+                        $result .= '"';
+                        $i++;
+                        break;
+                    case "'":
+                        $result .= "'";
+                        $i++;
+                        break;
+                    case '\\':
+                        $result .= '\\';
+                        $i++;
+                        break;
+                    case '/':
+                        $result .= '/';
+                        $i++;
+                        break;
+                    case 'b':
+                        $result .= "\b";
+                        $i++;
+                        break;
+                    case 'f':
+                        $result .= "\f";
+                        $i++;
+                        break;
+                    case 'n':
+                        $result .= "\n";
+                        $i++;
+                        break;
+                    case 'r':
+                        $result .= "\r";
+                        $i++;
+                        break;
+                    case 't':
+                        $result .= "\t";
+                        $i++;
+                        break;
+                    case 'u':
+                        if ($i + 5 < $length) {
+                            $hex = substr($str, $i + 2, 4);
+                            if (ctype_xdigit($hex)) {
+                                $codepoint = hexdec($hex);
+
+                                if ($codepoint >= 0xD800 && $codepoint <= 0xDBFF && $i + 11 < $length) {
+                                    if ('\\' === $str[$i + 6] && 'u' === $str[$i + 7]) {
+                                        $lowHex = substr($str, $i + 8, 4);
+                                        if (ctype_xdigit($lowHex)) {
+                                            $lowSurrogate = hexdec($lowHex);
+                                            if ($lowSurrogate >= 0xDC00 && $lowSurrogate <= 0xDFFF) {
+                                                $codepoint = 0x10000 + (($codepoint & 0x3FF) << 10) + ($lowSurrogate & 0x3FF);
+                                                $result .= mb_chr($codepoint, 'UTF-8');
+                                                $i += 11; // skip both escape sequences
+                                                break;
+                                            }
+                                        }
+                                    }
+                                }
+
+                                // single Unicode character or invalid surrogate
+                                $result .= mb_chr($codepoint, 'UTF-8');
+                                $i += 5;
+                            } else {
+                                // invalid hex, treat as literal
+                                $result .= $str[$i];
+                            }
+                        } else {
+                            // not enough characters for Unicode escape, treat as literal
+                            $result .= $str[$i];
+                        }
+                        break;
+                    default:
+                        // unknown escape sequence, keep the backslash
+                        $result .= $str[$i];
+                        break;
+                }
+            } else {
+                $result .= $str[$i];
+            }
+        }
+
+        return $result;
+    }
 }
diff --git a/src/Symfony/Component/JsonPath/Tests/JsonCrawlerTest.php b/src/Symfony/Component/JsonPath/Tests/JsonCrawlerTest.php
