Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(cli): escape single-quotes in dotenv key-values #1235

Open
wants to merge 3 commits into
base: main
Choose a base branch
from

Conversation

shamrt
Copy link

@shamrt shamrt commented Jan 23, 2024

import-meta-env does not escape all interpolated values correctly; specifically, nested single quotes in a dotenv key-value; e.g.:

KEY1=['value3', 'value4']
KEY2="This has 'single quotes' inside"

— both of which are valid dotenv variables.

When running those values through the import-meta-env CLI util, we'd get the following (invalid JSON string):

<script>
  globalThis.import_meta_env = JSON.parse('{"KEY1":"['value3', 'value4']","KEY2":"This has 'single quotes' inside"}');
</script>

The unescaped single-quotes invalidate the JSON string ☹️

My team has worked around this locally — i.e. by treating invalid JavaScript as text, slicing off the JSON.stringify('') wrapper, and parsing it in a separate script so that the syntax is valid — but we wanted to raise this issue upstream and propose a fix.

There is an outstanding question about how we might want to handle single-quotes in the alternate RegExp conditions (via createScriptPlaceholderRegExp), so I'd be happy to extend this PR further to account for those situations.

@shamrt shamrt changed the title test(cli): add specificity to test labels test(cli): escape single-quotes in dotenv key-values Jan 23, 2024
@shamrt shamrt changed the title test(cli): escape single-quotes in dotenv key-values fix(cli): escape single-quotes in dotenv key-values Jan 23, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant