Reject invalid unicode literals in the parser

PiperOrigin-RevId: 894137619

Author: l46kok

common/src/main/java/dev/cel/common/internal/Constants.java

@@ -207,6 +207,9 @@ private static <T> void decodeString(
             continue;
           }
           skipNewline = false;
+          if (codePoint >= MIN_SURROGATE && codePoint <= MAX_SURROGATE) {
+            throw new ParseException("Invalid unicode code point", seqOffset);
+          }
           buffer.appendCodePoint(codePoint);
         } else {
           // Normalize '\r' and '\r\n' to '\n'.
@@ -231,6 +234,9 @@ private static <T> void decodeString(
           // For raw literals, all escapes are valid and those characters come through literally in
           // the string.
           buffer.appendCodePoint('\\');
+          if (codePoint >= MIN_SURROGATE && codePoint <= MAX_SURROGATE) {
+            throw new ParseException("Invalid unicode code point", seqOffset);
+          }
           buffer.appendCodePoint(codePoint);
           continue;
         }

parser/src/test/java/dev/cel/parser/CelParserParameterizedTest.java

@@ -248,6 +248,10 @@ public void parser_errors() {
     runTest(PARSER, "1 + +");
     runTest(PARSER, "\"\\xFh\"");
     runTest(PARSER, "\"\\a\\b\\f\\n\\r\\t\\v\\'\\\"\\\\\\? Illegal escape \\>\"");
+    runTest(PARSER, "'\uD800'");
+    runTest(PARSER, "'\uDFFF'");
+    runTest(PARSER, "r\"\\\uD800\"");
+
     runTest(PARSER, "as");
     runTest(PARSER, "break");
     runTest(PARSER, "const");

parser/src/test/resources/parser_errors.baseline

@@ -85,6 +85,24 @@ ERROR: <input>:1:43: mismatched input '<EOF>' expecting {'[', '{', '(', '.', '-'
  | "\a\b\f\n\r\t\v\'\"\\\? Illegal escape \>"
  | ..........................................^
 
+I: '?'
+=====>
+E: ERROR: <input>:1:1: Invalid unicode code point
+ | '?'
+ | ^
+
+I: '?'
+=====>
+E: ERROR: <input>:1:1: Invalid unicode code point
+ | '?'
+ | ^
+
+I: r"\?"
+=====>
+E: ERROR: <input>:1:1: Invalid unicode code point
+ | r"\?"
+ | ^
+
 I: as
 =====>
 E: ERROR: <input>:1:1: reserved identifier: as