Dear Maintainer,

-[NSRegularExpression stringByReplacingMatchesInString:options:range:withTemplate:]
returns nil instead of @"" whenever the result of the replacement is
empty, e.g. when the pattern matches the whole input, or the input is
empty. -replaceMatchesInString:options:range:withTemplate: has the same
problem and leaves the mutable string untouched.

Debian builds the non-UText code path, which first asks ICU for the output
length with a zero-sized buffer:

  outLength = uregex_replaceAll(r, replacement, replLength, NULL, 0, &s);
  if (0 == s || U_BUFFER_OVERFLOW_ERROR == s)

For an empty result ICU returns 0 with U_STRING_NOT_TERMINATED_WARNING,
which is a warning (negative), not an error, but the "0 == s" check
treats it as a failure and the method returns nil.

Upstream fixed this in libs-base commit 188b2a3faee4 ("fix for issue
#800"), which replaces the "0 == s" checks with U_SUCCESS(s) throughout
Source/NSRegularExpression.m and adds test cases:

https://github.com/gnustep/libs-base/commit/188b2a3faee4e88d3371000690d0930e15545f06

The replacement hunks apply to 1.31.1 with small offsets. The two
uregex_lookingAt()/uregex_findNext() hunks need adjusting by hand, as
upstream refactored that code in 09de0f4720fa. Please consider
backporting it.

Thanks,
Jordi

We believe that the bug you reported is fixed in the latest version of
gnustep-base, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1150228@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Yavor Doganov <yavor@gnu.org> (supplier of updated gnustep-base package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 08 Oct 2026 04:40:44 +0300
Source: gnustep-base
Architecture: source
Version: 1.31.1-5
Distribution: unstable
Urgency: medium
Maintainer: Debian GNUstep maintainers <pkg-gnustep-maintainers@lists.alioth.debian.org>
Changed-By: Yavor Doganov <yavor@gnu.org>
Closes: 1150228
Changes:
 gnustep-base (1.31.1-5) unstable; urgency=medium
 .
   * debian/patches/NSRegularExpression-test-ICU-success.patch: New;
     backport upstream fix to test for ICU success (Closes: #1150228).
   * debian/templates/control.m4 (Build-Depends): Switch to dh compat 14.
     (Depends): Remove substvars.
     (Priority, Rules-Requires-Root): Remove; redundant.
     (Standards-Version): Compliant with 4.7.4 as of this release.
   * debian/control: Regenerate.
   * debian/watch: Upgrade to version 5.
   * debian/copyright: Update copyright years for Debian packaging.
   * debian/salsa-ci.yml: New file; extend the standard recipe to test the
     cross, nocheck and nodoc build profiles.
Checksums-Sha1:
 88d4558e4b1d459df4aab277b3ccc3207818ed88 3071 gnustep-base_1.31.1-5.dsc
 b3eefc34c2142e78465e118c67930fc695a3a5dc 44044 gnustep-base_1.31.1-5.debian.tar.xz
 05f819d9ea4dbbcbb40a9eaa7f64fb175a47fc6a 10374 gnustep-base_1.31.1-5_source.buildinfo
Checksums-Sha256:
 01dd671127ae02fcef85e07b7da9fafb7b59f6f5ef5891f91b348249e4e78e97 3071 gnustep-base_1.31.1-5.dsc
 21114b2f02523406db440caf315738fe0e79f5803394078afe3ac319b9e39450 44044 gnustep-base_1.31.1-5.debian.tar.xz
 b05c55411451dee84537af0833c6c5658063ee1a524fea6bb8e2e899455db9c2 10374 gnustep-base_1.31.1-5_source.buildinfo
Files:
 0f35208a1f525627bbff77edcab9abc8 3071 gnustep optional gnustep-base_1.31.1-5.dsc
 c55c742c60b2656514cb032b4af07c3f 44044 gnustep optional gnustep-base_1.31.1-5.debian.tar.xz
 88cf4575cdd6adc4fc56a671a7d941a8 10374 gnustep optional gnustep-base_1.31.1-5_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtgob82PcExn/Co6JEWhSvN91FcAFAmrH8xkACgkQEWhSvN91
FcC+zg/+PhKW72vx7Ul5f5bd8XMlBOBYodNg0n5QsZxXeiI3QNoYfOdYd2vvvlKE
89ZywPhmpzoCfAUwqrF9ZlinOgh0Aw0tRCug1H6U1ZuAY545G6QKmwh/mXdBu9xQ
9XjBGHF2OCW/sW1teOP5znFfiurIEqCv130GHup6YGwjGjbTVfyF9qWh5T5yXACg
1aX+5ggJtJLt/Xg86fmrXClsGdNrhNwWXDyjUWuxebeQMiSYOqrRspkaN5nLbWnf
ONe8WXHPqQ2WTi1JBtrx/aLEQAjzXPiJ55KlByGkHkrNCnmb+Dwa13NiimINJBOI
6ePXpqJT0U6/syS7joMmTfHIiJR+aIhJG1ekDh6gLV9f3ySLjP6zWYHK6+jxLGJv
edE8jgBIfRl+c/5cuLryMCjsyauyltD2EtLj3V5AWC9z9hHX+zhXER1ub4jJBzLL
VQX2YSPD0wzN9mEZQb1mTwuM0ZL+EiTqOL4WuvTJw/r1rUK+JBtilDGOLmrSUl1+
en7qiW2mrfiHF1VMhtpEjbwOEPm/vQ3jW6bKFO9VU1epFbR9COvkfgcpfmxagPue
CEnu/j8P1WT83HRwOMEpoRJyIge4Bn4i0G+ddUOsMYHvPuVZemqmNzyg9HgUPVgi
ibJf419ulWJJStoJSVOLNe3jJxbWvIDaH1CZdrcSJlcKBlfR1aQ=
=v1QR
-----END PGP SIGNATURE-----

Dear Maintainer,


This also affects stable. trixie still ships libgnustep-base1.31 1.31.1-3,
which lacks the NSRegularExpression fix (1.31.1-5 in unstable/testing).

sogo 5.12.1-3+deb13u3 (DSA-6561-1, trixie-security) adds XSS patches
("escape angularJS directive for description", "add stripAngular to
stringWithoutHTMLInjection calls", "use legitimate sorting value"). With
them on trixie I see two UI regressions:

- Webmail cannot return to the Inbox when the message list is sorted by
  "Order Received" (sort=arrival, the default). No request is sent and
  nothing is logged. With sort=date it works.
- The invitation card shows "{\{$chip.name}/}" instead of the attendee
  name, although the ATTENDEE line has a valid CN.

I suspect nil results from NSRegularExpression replacements that yield an
empty string, but I have not verified it. Could the fix be made available
in trixie / trixie-security?

Regards,
Ingo

Ingo Juergensmann wrote:

Looks bad enough to me.  Thanks for informing us; the upload of
sogo/5.12.11-1 to unstable contained some workaround for this bug so I
thought something similar was done for stable.

Sure, I'll prepare a pu for trixie but it's up to the release team to
approve it.