How to unescape JavaScript string literal value?

Question

I am using regex to parse javascript code (using an ES parser, such as Esprima, is not an option for technical environment limitations).

The subject code (the code being parsed is):

(function() {
    $('#3bf779cd').replaceWith("<div class=\'shows\'>\n<\/div>");

    window.fadeItems();
}).call(this);

The value I am interested in is the first parameter of replaceWith, which is a string literal. I am getting this variable using regex:

const subjectValue = subjectCode.match(/\.replaceWith\(((["'])(?:(?=(\\?))\3.)*?\2)/m)[1].slice(1, -1);

console.log(subjectValue);

The output of this is:

<div class=\'shows\'>\n<\/div>

How do I escape subjectValue in a way that the output would be:

<div class='shows'>
</div>

Simply using unescape has no effect.

If I am not mistaken, the question comes does to how to unescape this value:

console.log('"<div class=\\\'shows\\\'>\\\\n<\\\/div>"');

Looks like you need to use something like `replace`. See http://stackoverflow.com/questions/6640382/how-to-remove-backslash-escaping-from-a-javascript-var — Chris Lear, Feb 23 '16 at 14:32

score 2 · Answer 1 · answered Feb 23 '16 at 14:43

2

You're looking for eval (yes you heard correctly):

text = document.querySelector('script').textContent;

dqString = /"(\\.|[^"])*"/g

s = text.match(dqString)[0]

raw = eval(s);

alert(raw);

<script>
(function() {
    $('#3bf779cd').replaceWith("<div class=\'shows\'>\n<\/div>");
    window.fadeItems();
});
</script>

answered Feb 23 '16 at 14:43

georg

This is an interesting (and effective) approach, but are there still considerations for using `eval` safely (see: [When is JavaScript's eval() not evil?](http://stackoverflow.com/questions/197769/when-is-javascripts-eval-not-evil). Also, your regex is loose enough to capture any `"` quoted string. If that is desired, you could get away with `/"[^"]+"/g`; but if you want to limit it to strings that contain a backslash, you should use a pattern similar to `/"[^"]*\\+[^"]*"/g` – gfullam Feb 23 '16 at 15:16

score 0 · Answer 2 · answered Feb 23 '16 at 14:34

The most idiotic way would be.

"<div class=\\'shows\\'>\\\\n<\\/div>".replace(/\\n/g, '').replace(/\\/g, '');
// "<div class='shows'></div>"

Smarter way would be to first unescape \n's than check with regex if there are unescaped matches, and than escape those as well.

2 Answers2