repl: no RegExp side effects for static properties

[princejwesley]

Disallow global RegExp object usage inside repl.js,
readline.js and tty.js. Use RegExp from internal context
to prevent updating global.RegExp static properties

tools/eslint-rules/no-regex-literal-for-repl.js linter is added
to prevent regex literal usage in repl code path

Fixes: #18931

Checklist

• make -j4 test (UNIX), or vcbuild test (Windows) passes
• tests and/or benchmarks are included (TODO)
• documentation is changed or added
• commit message follows commit guidelines

[addaleax]

I think this is basically what lib/internal/safe_globals.js is there for, right? Can we do it that way?

[princejwesley]

@addaleax Adding SafeRegExp or move 'internal/util'.getInternalGlobal to internal/safe_globals.js ? SafeRegExp would have the same side effect if its implemented by makeSafe.

[apapirovski]

@princejwesley The PR looks mostly good to me but a) could you elaborate why makeSafe wouldn't work here? I've only briefly skimmed the related issue.

Also, is there any way to add a test for 1) the eslint rule, and 2) the behaviour of the new code not adding any globals?

[BridgeAR]

I am not a fan of this since AFAIK it takes longer to generate the RegExp like this and it becomes more difficult to read the RegExp. I think we should use a different approach.

[BridgeAR]

I am not sure how we should progress here. I personally do not think this is the solution to our issue. Is this still WIP?

[lundibundi]

ping @princejwesley, will you be working on this or can we close it?

[princejwesley]

we can close it

[BridgeAR]

I looked into this issue and it seems like this is the only halfway reliable way to really solve this. Sorry for originally being sceptical.

[bnoordhuis]

This PR looks mostly fine to me, the only worry I have is that it might introduce performance regressions. Specifically, people sometimes use readline to parse large inputs.

[BridgeAR]

One way to reduce the performance overhead is to create the RegExp once up front and safe it as top level variable. That should be always possible besides for the cases where we have to create the regular expression based upon input and those will also need the constructor right now.

I wonder if it's possible to use the primordials RegExp constructor.