Use String#undump instead of eval

[kou]

String#undump is enough to parse a string literal.

[Copilot]

Pull request overview

This PR updates Racc’s grammar file lexer (GrammarFileParser#yylex0) to avoid eval when parsing quoted string literals, aiming to reduce code execution risk by using String#undump instead.

Changes:

• Replaces eval(scan_quoted(...)) with String#undump for string-literal parsing.
• Adds a conversion step intended to make single-quoted literals compatible with undump.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[hsbt]

Grammar files that use raw non-ASCII characters in double-quoted string tokens (e.g. "あ") now raise RuntimeError: non-ASCII character detected, because String#undump only accepts ASCII input. Escaping non-ASCII characters to \u{...} before calling undump avoids this:

string = string_literal.gsub(/[^\x00-\x7F]/) { |c| "\\u{%x}" % c.ord }.undump

undump decodes \u escapes back to UTF-8, so the result is the same as eval for UTF-8 sources.

[kou]

Good point. I didn't notice it.

string_literal is ASCII-8BIT here because String#b is used in #initialize. And input may not be UTF-8. So I used \xHH not \uHHHH.