From a0acc63c7d0171f1b45bebf9d74744515f9217c7 Mon Sep 17 00:00:00 2001
From: daurnimator <quae@daurnimator.com>
Date: Mon, 29 May 2017 17:18:58 +1000
Subject: Don't pass user input as format to luaL_error

---
 src/lstrlib.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/lstrlib.js')

diff --git a/src/lstrlib.js b/src/lstrlib.js
index 41c48ef..56817a0 100644
--- a/src/lstrlib.js
+++ b/src/lstrlib.js
@@ -1107,7 +1107,7 @@ const push_onecapture = function(ms, i, s, e) {
         if (i === 0)
             lua.lua_pushlstring(ms.L, ms.src.slice(s), e - s);  /* add whole match */
         else
-            lauxlib.luaL_error(ms.L, lua.to_luastring(`invalid capture index %${i + 1}`));
+            lauxlib.luaL_error(ms.L, lua.to_luastring("invalid capture index %%%d"), i + 1);
     } else {
         let l = ms.capture[i].len;
         if (l === CAP_UNFINISHED) lauxlib.luaL_error(ms.L, lua.to_luastring("unfinished capture", true));
-- 
cgit v1.2.3-54-g00ecf