Merge contributor C1 control update into JavaScript PR

Author: jmanico

core/src/main/java/org/owasp/encoder/JavaScriptEncoder.java

@@ -123,6 +123,7 @@ enum Mode {
         // '`', '$', and '{' are encoded in every mode for ordinary template
         // literal text. An unescaped '`' ends the literal; "${" starts an
         // expression even when '$' is trusted text before the encoded input.
+        // DEL is hex-encoded in every mode, like the C1 controls.
         _validMasks = new int[]{
             0,
             -1 & ~((1 << '\'') | (1 << '\"') | (1 << '$')),
@@ -164,7 +165,7 @@ int firstEncodedOffset(String input, int off, int len) {
                 if ((validMasks[ch >>> 5] & (1 << ch)) == 0) {
                     return i;
                 }
-            } else if (_asciiOnly || ch <= 0x9f
+            } else if (_asciiOnly || ch <= Unicode.MAX_C1_CTRL_CHAR
                     || ch == Unicode.LINE_SEPARATOR || ch == Unicode.PARAGRAPH_SEPARATOR) {
                 return i;
             } else if (Character.isHighSurrogate(ch)) {
@@ -202,7 +203,7 @@ protected CoderResult encodeArrays(CharBuffer input, CharBuffer output, boolean
                             break encoded;
                         }
                     } else {
-                        if (ch <= 0x9f || (_asciiOnly && ch <= 0xff)) {
+                        if (ch <= Unicode.MAX_C1_CTRL_CHAR || (_asciiOnly && ch <= 0xff)) {
                             break hexEncoded;
                         }
                         if (!_asciiOnly && Character.isHighSurrogate(ch)) {

core/src/test/java/org/owasp/encoder/JavaScriptEncoderTest.java

@@ -101,9 +101,6 @@ public static Test suite() {
                     .encode("NUL", "\\x00", "\0")
                     .encode("Line Separator", "\\u2028", "\u2028")
                     .encode("Paragraph Separator", "\\u2029", "\u2029")
-                    .encode("DEL", "\\x7f", "\u007f")
-                    .encode("NEL", "\\x85", "\u0085")
-                    .encode("last C1 control", "\\x9f", "\u009f")
                     .encode("lone high surrogate", "\\ud800", "\ud800")
                     .encode("lone low surrogate", "\\udfff", "\udfff")
                     .encode("reversed pair", "\\udc00\\ud800", "\udc00\ud800")
@@ -118,7 +115,14 @@ public static Test suite() {
                     .encode("template expression", "\\x24\\x7balert(1)}", "${alert(1)}")
                     .encode("template breakout", "hell\\x60;alert(1);\\x60o", "hell`;alert(1);`o")
                     .encode("abc", "abc")
-                    .encode("ABC", "ABC");
+                    .encode("ABC", "ABC")
+                    // DEL and the C1 controls are hex encoded in every mode
+                    .encode("DEL", "\\x7f", "\u007f")
+                    .encode("U+0080", "\\x80", "\u0080")
+                    .encode("NEL", "\\x85", "\u0085")
+                    .encode("CSI", "\\x9b", "\u009b")
+                    .encode("U+009F", "\\x9f", "\u009f")
+                    .encode("NEL in text", "a\\x85b", "a\u0085b");
 
                 if (asciiOnly == 0) {
                     builder
@@ -127,7 +131,7 @@ public static Test suite() {
                         .encode("non-breaking space", "\u00a0", "\u00a0")
                         .encode("surrogate pair", "\ud83d\ude00", "\ud83d\ude00")
                         .valid(0xa0, Character.MAX_CODE_POINT)
-                        .encoded(0x7f, 0x9f)
+                        .encoded(0x7f, Unicode.MAX_C1_CTRL_CHAR)
                         .encoded(Character.MIN_SURROGATE, Character.MAX_SURROGATE)
                         .encoded("\u2028\u2029");
                 } else {