mattermost/webapp/channels/babel.config.js
Miguel de la Cruz 6b20092e7a
Fix MM-57406: prevent IPv6 hex segments from parsing as emoji (#36541)
* Fix MM-57406: prevent IPv6 hex segments from parsing as emoji

Add word-boundary lookbehind and lookahead to EMOJI_PATTERN so a
:name: token is only matched when neither side abuts an
alphanumeric/underscore. Without this, hex runs in IPv6
addresses (e.g. :beef: in 2001:18:1:beef::/64) were tokenized and
rendered as custom emoji. The new semantics align with the server
parser at server/public/shared/markdown/emoji.go.

Bump the webapp babel safari target from 16.2 to 16.4 since regex
lookbehind is a syntax feature and is not lowered by
@babel/preset-env. The actual supported minimum is well above 16.4, so
the previous target was stale.

Add regression tests for the IPv6 case and guardrail tests for
back-to-back, paren-wrapped, and punctuation-terminated emoji.  Update
the existing asdf🐐asdf💨asdf test to reflect the
new (server-aligned) semantics.

* Dedupe word-char class in EMOJI_PATTERN

Use \w in the lookarounds and inside the name matcher ([\w+-])
so the word-char set is expressed once instead of being repeated
as two slightly different literal character classes. Same set,
same semantics; addresses review feedback on PR #36541.

---------

Co-authored-by: Miguel de la Cruz <miguel@ctrlz.es>
2026-05-21 10:34:30 +02:00

40 lines
973 B
JavaScript

// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
// See LICENSE.txt for license information.
const {dependencies} = require('./package.json');
const corejsVersion = dependencies['core-js'];
const config = {
presets: [
['@babel/preset-env', {
targets: {
chrome: 110,
firefox: 102,
edge: 110,
safari: '16.4',
},
corejs: corejsVersion,
useBuiltIns: 'usage',
shippedProposals: true,
}],
['@babel/preset-react', {
useBuiltIns: true,
}],
['@babel/typescript', {
allExtensions: true,
isTSX: true,
}],
],
plugins: [
[
'babel-plugin-styled-components',
{
ssr: false,
fileName: false,
},
],
],
sourceType: 'unambiguous',
};
module.exports = config;