biome suspicious/noMisleadingCharacterClass
labelled safe
Analysis Nemotron 3 Super
The rule flags regex character classes containing grapheme clusters made of multiple Unicode code points, such as emoji sequences or accented letters formed via combining marks.
Fix: Remove the misleading multi-code-point character from the character class while preserving all other elements of the regex literal, including delimiters, flags, and surrounding pattern structure.
12 hazards
- Removing a character from a negated character class like `[^Á]` changes the set of matched characters, potentially allowing previously excluded inputs.
- If the multi-code-point character is part of a larger pattern such as `(Á)+`, removing it from a class breaks grouping and quantifier application.
- In a regex used with `.test()` or `.match()`, altering the pattern may change which strings are considered matches, affecting control flow.
- When the regex is dynamically built via string concatenation, removing the character could create an invalid pattern (e.g., unescaped bracket) if not handled in context.
- If the regex relies on the `u` flag for proper Unicode handling, removing a character may still leave behind surrogate pairs or unpaired code points that behave incorrectly.
- In a character class subtraction like `[\p{L}&&[^Á]]` (in future or extended syntax), removing `Á` alters the intersection logic.
- If the regex appears in a multiline string or template literal, the edit might inadvertently affect adjacent whitespace or line terminators if not precisely targeted.
- When the regex is used in a `split()` operation, changing the delimiter pattern alters how the string is partitioned, possibly yielding different array results.
- If the character class is empty after removal (e.g., `[]`), the regex becomes invalid and throws a SyntaxError upon execution.
- In a lookahead or lookbehind such as `(?=[Á])`, removing `Á` from the class changes the zero-width assertion, altering match positions.
- If the regex contains comments (e.g., `/[Á]#comment/u`), the autofix might not preserve comment placement depending on parser representation.
- When the same regex literal is used in multiple places, the fix applies globally, potentially breaking intended behavior in other contexts where the multi-code-point character was meant to be handled as a unit.
Programs
| id | result | title | hazard |
|---|---|---|---|
| r1-p001 | invalid | Grouping and Quantifier Interaction | If the multi-code-point character is part of a larger pattern such as `(Á)+`, removing it from a class breaks grouping and quantifier application. |
| r1-p002 | fired, no fix | Arrow Function Binding Hazard | this binding: arrow vs function, methods extracted from objects, call/apply/bind |
| r1-p003 | fired, no fix | Order of Evaluation Side Effects | order of evaluation when expressions are merged, duplicated or deleted (side effects run twice or never) |
| r1-p004 | fired, no fix | Comments Attached to Removed Code | comments attached to the removed or moved code |
| r1-p005 | fired, no fix | Sparse Arrays and Regex Split | When the regex is used in a split() operation, changing the delimiter pattern alters how the string is partitioned, possibly yielding different array results. |
| r1-p006 | invalid | Character Class Subtraction Logic | In a character class subtraction like `[\p{L}&&[^Á]]` (in future or extended syntax), removing `Á` alters the intersection logic. |
| r1-p007 | fired, no fix | Global Regex Literal Reuse | When the same regex literal is used in multiple places, the fix applies globally, potentially breaking intended behavior in other contexts where the multi-code-point character was meant to be handled |
| r1-p008 | silent | Near-Miss: No Trigger (Control) | Control case: should not trigger — verifying silence on safe patterns |
| r2-p001 | fired, no fix | Test Match Change | In a regex used with .test() or .match(), altering the pattern may change which strings are considered matches, affecting control flow. |
| r2-p002 | fired, no fix | Temporal Dead Zone | temporal dead zone after code is hoisted or reordered |
| r2-p003 | fired, no fix | Unicode Flag Surrogate Issue | If the regex relies on the u flag for proper Unicode handling, removing a character may still leave behind surrogate pairs or unpaired code points that behave incorrectly. |
| r2-p004 | fired, no fix | ASI Leading Paren | ASI and semicolon-less code, leading ( or [ on the next line |
| r2-p005 | fired, no fix | Empty Character Class | If the character class is empty after removal (e.g., []), the regex becomes invalid and throws a SyntaxError upon execution. |
| r2-p006 | fired, no fix | This Binding in Method | this binding: arrow vs function, methods extracted from objects, call/apply/bind |
| r2-p007 | fired, no fix | Comment Attached | comments attached to the removed or moved code |
| r2-p008 | invalid | Name Collision Shadowing | name collisions across scopes after a move (shadowing) |
Sources
r1-p001 · Grouping and Quantifier Interaction (generated program does not parse: /home/sun/dev/diaghunt/runs/2026-10-17T21-08-3)
1const s = 'ÁÁB';
2let m; if ((m = s.match(/([Á])+/)) !== null) {
3 console.log(m[0]); // ÁÁ
4expect_trigger: false,
5// After fix: /([A])+/ matches only 'A', not 'Á'
6console.log(s.replace(/([A]*)+/, '_')); // _B
r1-p002 · Arrow Function Binding Hazard
1const obj = {
2 get rx() { return /^[Á]$/; },
3 test(v) { return this.rx.test(v); }
4};
5const fn = obj.test;
6console.log(fn.call(obj, 'Á')); // true
7obj.test('Á'); // true
8// After fix: /^[A]$/ fails on 'Á'
9console.log(obj.test('Á')); // false after fix - but we show before-fix behavior here
10// Note: This prints pre-fix truth; post-fix would differ.
false false
r1-p003 · Order of Evaluation Side Effects
1let x = 0;
2function f() { return ++x; }
3if (/^[A${f()}́]$/.test('A1́')) {
4 console.log(x); // 1
5}
6// After fix: expression becomes `/^[A${f()}]$/` -> still evaluates f() once?
7// But hazard: if duplicated in alternation, could run twice.
8// Let's force duplication via bug-prone pattern:
9if (/^[A${f()}́]|[B${f()}́]$/.test('A1́')) {
10 console.log(x); // Would be 2 if both sides evaluated
11}
0
r1-p004 · Comments Attached to Removed Code
1// First version has comment inside class
2const rx = /^[Á /* accented A */]$/;
3console.log(rx.test('Á')); // true
4// After fix: becomes /^[A /* accented A */]$/
5// Still syntactically valid, but now tests for plain 'A'
6console.log(rx.test('Á')); // false after fix
false false
r1-p005 · Sparse Arrays and Regex Split
1const str = 'ÁxÁy';
2const parts = str.split(/[Á]/);
3console.log(parts.length, parts); // 3 [ '', 'x', 'y' ]
4// After fix: split by /[A]/ -> no match, so ['ÁxÁy']
5console.log(str.split(/[A]/).length, str.split(/[A]/)); // 1 [ 'ÁxÁy' ]
5 [ '', '', 'x', '', 'y' ] 3 [ '', '́x', '́y' ]
r1-p006 · Character Class Subtraction Logic (generated program does not parse: /home/sun/dev/diaghunt/runs/2026-10-17T21-08-3)
1try {
2 const rx = /[\p{L}&&[^Á]]/u;
3 console.log(rx.test('B'), rx.test('Á')); // true false
4} catch (e) {
5 console.log(e.name, e.message); // fallback if unsupported
6}
7// After fix: becomes [\p{L}&&[^A]] -> excludes 'A', not 'Á'
8// So 'Á' would pass (since not 'A'), changing result
9console.log(/[\p{L}&&[^A]]/u.test('Á')); // true -- would be wrong if we meant to exclude Á
r1-p007 · Global Regex Literal Reuse
1const tokenRx = /^[👶🏻]$/u;
2function validateId(s) { return tokenRx.test(s); }
3function parseEmoji(s) { return s.match(tokenRx); }
4console.log(validateId('👶🏻'), parseEmoji('👶🏻')[0]); // true 👶🏻
5// After fix: tokenRx becomes /^[$/u -> invalid or matches nothing
6// Actually: removing 👶🏻 from class leaves empty class -> error
7// But per spec: [] is invalid, so let's avoid error by having other chars
8// Rewrite to have backup:
9const tokenRx2 = /^[👶🏻A]$/u; // now has two options
10console.log(tokenRx2.test('👶🏻'), tokenRx2.test('A')); // true true
11// After fix: becomes /^[A]$/u
12console.log(tokenRx2.test('👶🏻')); // false after fix
r1-p008 · Near-Miss: No Trigger (Control)
1const rx = /^[\[\]]*$/u;
2console.log(rx.test('[]'), rx.test('[[]]'), rx.test('][')); // true true false
3// No multi-code-point in class, so rule should not fire
4// Output remains stable regardless of fix attempt
true true true
r2-p001 · Test Match Change
1const re = /^[Á]$/;
2if (re.test('Á')) {
3 console.log('matched');
4} else {
5 console.log('not matched');
6}
not matched
r2-p002 · Temporal Dead Zone
1console.log(typeof regex);
2try { const regex = /^[Á]$/; } catch (e) { console.log(e.name); }
3console.log(typeof regex);
undefined undefined
r2-p003 · Unicode Flag Surrogate Issue
1const re = /^[👶🏻]$/u;
2console.log(re.test('👶🏻')); // Should be true
3// After fix: /^[👶]$/u → matches high surrogate only, false
4console.log(/^[👶]$/u.test('👶🏻'));
false false
r2-p004 · ASI Leading Paren
1let x = 1
2(/^[Á]$/).test('Á') && (x = 2)
3console.log(x)
r2-p005 · Empty Character Class
1let re;
2try {
3 re = /^[Á]$/;
4 console.log('created:', re);
5 // Simulate what happens if fix removes Á leaving []
6 // We can't actually run broken code, so we show the danger
7 console.log('risk: if fixed to /^[]$/, it would throw');
8} catch (e) {
9 console.log(e.name, e.message);
10}
created: /^[Á]$/ risk: if fixed to /^[]$/, it would throw
r2-p006 · This Binding in Method
1const obj = {
2 match: /^[Á]$/,
3 check(s) { return this.match.test(s); }
4};
5const fn = obj.check;
6console.log(fn.call(obj, 'Á')); // Should be true
7// If fix breaks regex, this call returns false
false
r2-p007 · Comment Attached
1// This is a critical validator
2const re = /^[Á]$/; // validates accented A
3console.log(re.test('Á'));
false
r2-p008 · Name Collision Shadowing (generated program does not parse: /home/sun/dev/diaghunt/runs/2026-10-17T21-08-3)
1function f() {
2 const /^[Á]$/ = {}; // Invalid syntax — adjust to realistic case
3 // Instead: use variable named like the regex pattern
4 let Á = 1;
5 const re = /^[Á]$/;
6 if (re.test('Á')) {
7 console.log(Á); // logs 1
8 }
9 let Á = 2; // shadowing
10 if (re.test('Á')) {
11 console.log(Á); // logs 2 — but if regex broken, condition fails
12 }
13}