From 8d5f3a5290b94200d4e6479a95943624b300aff2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ren=C3=A9=20Kijewski?= <rene.kijewski@fu-berlin.de>
Date: Tue, 19 Aug 2025 22:12:52 +0200
Subject: [PATCH] parser: `r#_` is not a valid identifier

Resolves <https://issues.oss-fuzz.com/issues/439492383>.
---
 askama_parser/src/expr.rs                         |   7 +++----
 askama_parser/src/tests.rs                        |   2 +-
 ...uzz-testcase-minimized-derive-6380739026550784 | Bin 0 -> 483 bytes
 3 files changed, 4 insertions(+), 5 deletions(-)
 create mode 100644 fuzzing/fuzz/artifacts/derive/clusterfuzz-testcase-minimized-derive-6380739026550784

diff --git a/askama_parser/src/expr.rs b/askama_parser/src/expr.rs
index e1dfc378..3ebc4ba3 100644
--- a/askama_parser/src/expr.rs
+++ b/askama_parser/src/expr.rs
@@ -9,9 +9,8 @@ use winnow::token::{any, one_of, take, take_until};
 use crate::node::CondTest;
 use crate::{
     CharLit, ErrorContext, HashSet, InputStream, Num, ParseResult, PathOrIdentifier, StrLit,
-    StrPrefix, WithSpan, can_be_variable_name, char_lit, cut_error, filter, identifier,
-    is_rust_keyword, keyword, not_suffix_with_hash, num_lit, path_or_identifier, skip_ws0,
-    skip_ws1, str_lit, ws,
+    StrPrefix, WithSpan, char_lit, cut_error, filter, identifier, is_rust_keyword, keyword,
+    not_suffix_with_hash, num_lit, path_or_identifier, skip_ws0, skip_ws1, str_lit, ws,
 };
 
 macro_rules! expr_prec_layer {
@@ -1100,7 +1099,7 @@ impl<'a: 'l, 'l> Suffix<'a> {
                     )
                 } else {
                     // a raw identifier like `r#async`
-                    if !can_be_variable_name(id) {
+                    if matches!(id, "self" | "Self" | "super" | "crate" | "_") {
                         cut_error!(
                             format!("`{}` cannot be a raw identifier", id.escape_debug()),
                             span,
diff --git a/askama_parser/src/tests.rs b/askama_parser/src/tests.rs
index f57fee7c..e6facca0 100644
--- a/askama_parser/src/tests.rs
+++ b/askama_parser/src/tests.rs
@@ -1625,7 +1625,7 @@ fn test_macro_call_illegal_raw_identifier() {
     // Regression test for <https://issues.oss-fuzz.com/issues/435218013>.
     let syntax = Syntax::default();
 
-    for id in ["crate", "self", "Self", "super"] {
+    for id in ["crate", "self", "Self", "super", "_"] {
         assert!(
             Ast::from_str(&format!("{{{{ z!(r#{id}) }}}}"), None, &syntax)
                 .unwrap_err()
diff --git a/fuzzing/fuzz/artifacts/derive/clusterfuzz-testcase-minimized-derive-6380739026550784 b/fuzzing/fuzz/artifacts/derive/clusterfuzz-testcase-minimized-derive-6380739026550784
new file mode 100644
index 0000000000000000000000000000000000000000..751c97b44bc0b3d6ef27ccf1567c8291e04ec4e4
GIT binary patch
literal 483
zcmezW|1=*1k4ANMYF=rsf})0jotBY8yn<bka=e0qmJyK7EiEb1wAaelDoaeQt*tFC
zn+yc`lYKxSf4KmVboJS}*<ha!4@ktvr#asz&d29bP-<~$PKlq7PnZu-8X^TIfqbCA
zI=Dy<kOkBORtS{f0kVJqY6@Jx3Pc#9xhS=yv?veBh_JM@wEzE4^C(y6m+B=BMi>95
TI=~+WdTD8MfPunpVo?JCg*E5x

literal 0
HcmV?d00001