From 7fb20f10fe3a1e1b561a1d2bf1e5c157d004a165 Mon Sep 17 00:00:00 2001
From: Sutou Kouhei <kou@clear-code.com>
Date: Fri, 10 Jul 2026 13:47:51 +0900
Subject: [PATCH] Use String#undump instead of eval

String#undump is enough to parse a string literal.
---
 lib/racc/grammarfileparser.rb | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/lib/racc/grammarfileparser.rb b/lib/racc/grammarfileparser.rb
index 3aa9b7d3..a34fdbe3 100644
--- a/lib/racc/grammarfileparser.rb
+++ b/lib/racc/grammarfileparser.rb
@@ -456,7 +456,16 @@ def yylex0
           elsif ch = reads(/\A./)
             case ch
             when '"', "'"
-              yield [:STRING, eval(scan_quoted(ch))]
+              string_literal = scan_quoted(ch)
+              if ch == "'"
+                # We can't use String#undump for '...'.
+                string = string_literal[1..-2].gsub(/\\\\|\\'/) do |matched|
+                  matched[1]
+                end
+              else
+                string = string_literal.undump
+              end
+              yield [:STRING, string]
             when '{'
               lineno = lineno()
               yield [:ACTION, SourceText.new(scan_action(), @filename, lineno)]