Leaked micromatch implementation behaviour

[janat08]

Environment

• OS Version: ubuntu 19.04
• Node.js Version: 10.15.3

I won't pretend to understand the issue. This manifests in downstream package: sindresorhus/globby#97 (comment).

[jonschlinkert]

From the linked issue:

fast-glob uses micromatch, which turns tmp\\*.{md,tmp} into tmp//*.(md|tmp) using brace expansion. When noext is specified, literal parentheses get matched:

Micromatch explicitly does not convert \\ to / in globs, as that is unsafe and could enable malicious regular expressions to be used.

Regarding the parentheses, that's a completely separate issue. Parentheses should only be matched literally when 1) noext is true, and 2) when literal parentheses were actually defined in the glob pattern. In your example, braces are used, which should not result in the behavior you're describing. If I recall correctly, this is one of the use cases I mentioned would happen if we escaped characters automatically, so I'm pretty sure that cause is not micromatch. However, I might be wrong, as my memory isn't all that great these days. If that is indeed caused in micromatch, please open an issue and I'll get it fixed right away.

[jonschlinkert]

related:

• feat: add replaceSeparatorsForGlob utility micromatch/micromatch#142 (comment)
• Incorrect matching for parenthesis micromatch/picomatch#7

[mrmlnc]

So, looks like bug in micromatch@3.

Tasks:

[
    {
        base: 'fixtures',
        dynamic: true,
        patterns: ['fixtures/**/*.{md,txt}'],
        positive: ['fixtures/**/*.{md,txt}'],
        negative: []
    }
]

Micromatch options:

{
    dot: false,
    nobrace: false,
    noglobstar: false,
    noext: true,
    nocase: false,
    matchBase: false
}

micromatch@3

RegExp:

/^(?:(?:\.[\\\/](?=.))?fixtures[\\\/]?\b(?!\.)(?:(?!(?:[\\\/]|^)\.).)*?[\\\/](?!\.)(?=.)[^\\\/]*?\.\(md|txt\)(?:[\\\/]|$))$/

When the noext option has false as value:

/^(?:(?:\.[\\\/](?=.))?fixtures[\\\/]?\b(?!\.)(?:(?!(?:[\\\/]|^)\.).)*?[\\\/](?!\.)(?=.)[^\\\/]*?\.(?:md|txt)(?:[\\\/]|$))$/

micromatch@4

RegExp:

/^(?:fixtures(?:[\\\/](?!\.)(?:(?:(?!(?:^|[\\\/])\.).)*?)[\\\/]|[\\\/]|$)(?!\.)(?=.)[^\\\/]*?\.(md|txt))$/

When the noext option has false as value:

/^(?:fixtures(?:[\\\/](?!\.)(?:(?:(?!(?:^|[\\\/])\.).)*?)[\\\/]|[\\\/]|$)(?!\.)(?=.)[^\\\/]*?\.(md|txt))$/

[mrmlnc]

Closing in favor of issue to use micromatch@4 (#154). This issue will be fixed with release fast-glob@3. You can check release issue #181.