fix: freeze built-in modes to prevent grammars altering them (#2271)

- previously a ill-behaved grammar could change the global modes
- this commit prevents that behavior
- fix(mercury): don't change global STRING modes
- clarify that for now `inherit` is shallow

CHANGES.md

@@ -7,7 +7,8 @@ New styles:
   none.
 
 Improvements:
-
+- fix(mercury): don't change global STRING modes (#2271) [Josh Goebel][]
+- fix: freeze built-in modes to prevent grammars altering them (#2271) [Josh Goebel][]
 - enh(xml) expand and improve document type highlighting (#2287) [w3suli][]
 - enh(parser) add safe & debug modes.  Better error handling for crash conditions. (#2286) [Josh Goebel][]
 - enh(ebnf) add underscore as allowed meta identifier character, and dot as terminator (#2281) [Chris Marchesi][]

src/highlight.js

@@ -112,6 +112,12 @@ https://highlightjs.org/
     }
   }
 
+  /**
+   * performs a shallow merge of multiple objects into one
+   *
+   * @arguments list of objects with properties to merge
+   * @returns a single new object
+   */
   function inherit(parent) {  // inherit(parent, override_obj, override_obj, ...)
     var key;
     var result = {};
@@ -261,6 +267,9 @@ https://highlightjs.org/
     if (dependencyOnParent(mode))
       return [inherit(mode, { starts: mode.starts ? inherit(mode.starts) : null })];
 
+    if (Object.isFrozen(mode))
+      return [inherit(mode)];
+
     // no special dependency issues, just return ourselves
     return [mode];
   }
@@ -1068,5 +1077,48 @@ https://highlightjs.org/
     relevance: 0
   };
 
+  var constants = [
+    hljs.IDENT_RE,
+    hljs.UNDERSCORE_IDENT_RE,
+    hljs.NUMBER_RE,
+    hljs.C_NUMBER_RE,
+    hljs.BINARY_NUMBER_RE,
+    hljs.RE_STARTERS_RE,
+    hljs.BACKSLASH_ESCAPE,
+    hljs.APOS_STRING_MODE,
+    hljs.QUOTE_STRING_MODE,
+    hljs.PHRASAL_WORDS_MODE,
+    hljs.COMMENT,
+    hljs.C_LINE_COMMENT_MODE,
+    hljs.C_BLOCK_COMMENT_MODE,
+    hljs.HASH_COMMENT_MODE,
+    hljs.NUMBER_MODE,
+    hljs.C_NUMBER_MODE,
+    hljs.BINARY_NUMBER_MODE,
+    hljs.CSS_NUMBER_MODE,
+    hljs.REGEXP_MODE,
+    hljs.TITLE_MODE,
+    hljs.UNDERSCORE_TITLE_MODE,
+    hljs.METHOD_GUARD
+  ]
+  constants.forEach(function(obj) { deepFreeze(obj); });
+
+  // https://github.com/substack/deep-freeze/blob/master/index.js
+  function deepFreeze (o) {
+    Object.freeze(o);
+
+    Object.getOwnPropertyNames(o).forEach(function (prop) {
+      if (o.hasOwnProperty(prop)
+      && o[prop] !== null
+      && (typeof o[prop] === "object" || typeof o[prop] === "function")
+      && !Object.isFrozen(o[prop])) {
+        deepFreeze(o[prop]);
+      }
+    });
+
+    return o;
+  };
+
+
   return hljs;
 }));

src/languages/mercury.js

@@ -49,6 +49,7 @@ function(hljs) {
     begin: '\\\\[abfnrtv]\\|\\\\x[0-9a-fA-F]*\\\\\\|%[-+# *.0-9]*[dioxXucsfeEgGp]',
     relevance: 0
   };
+  STRING.contains = STRING.contains.slice() // we need our own copy of contains
   STRING.contains.push(STRING_FMT);
 
   var IMPLICATION = {