Function stringToPath

packages/remeda/src/stringToPath.ts:90–140

(
  path: Path,
)

 * @category Utility
 */
export function stringToPath<const Path extends string>(
  path: Path,
): StringToPath<Path> {
  const result: (string | number)[] = [];

  // There are four possible ways to define a path segment::
  // - `propName`: is used to parse dot-notation paths, e.g. 'foo.bar.baz', we
  // allow multiple sequential dots because our type allows them, but they are
  // semantically meaningless. Note that this would also allow strings starting
  // with a dot, e.g. `.foo`, this is fine because the dot itself is just used
  // as a separator and is ignored in the final path.
  // - `quoted`, `doubleQuoted`: used within square bracket notation to prevent
  // any recursive parsing of their contents. As for the type itself, we only
  // allow quote symbols to appear immediately after the opening square bracket
  // and immediately before the closing square bracket, this allows us to handle
  // more gracefully cases where a quote symbol might appear within the quoted
  // part.
  // - `unquoted`: If the contents of the square brackets are not quoted they
  // will match this group (this is why the order is important here!). Contents
  // of this group get parsed *recursively*.
  //
  // NOTE: We limit all repeats to 4096 characters to avoid a possible attack
  // vector when the input to this function is controlled by the user. This is
  // due to a DoS timing attack because regex backtracking is non-linear.
  // @see: https://codeql.github.com/codeql-query-help/javascript/js-polynomial-redos/
  const pathSegmentRe =
    /\.{0,4096}(?<propName>[^.[\]]+)|\['(?<quoted>.{0,4096}?)'\]|\["(?<doubleQuoted>.{0,4096}?)"\]|\[(?<unquoted>.{0,4096}?)\]/uy;

  let match: RegExpExecArray | null;
  while ((match = pathSegmentRe.exec(path)) !== null) {
    const { propName, quoted, doubleQuoted, unquoted } = match.groups!;

    if (unquoted !== undefined) {
      result.push(...stringToPath(unquoted));
      continue;
    }

    result.push(
      propName === undefined
        ? (quoted ?? doubleQuoted!)
        : // The only way to differentiate between array indices and properties
          // is to check if the property is a non-negative integer. In those
          // cases we perform the conversion (unlike Lodash).
          NON_NEGATIVE_INTEGER_RE.test(propName)
          ? Number(propName)
          : propName,
    );
  }

  return result;
}