fix(cli): escape single-quotes in dotenv key-values #1235
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
import-meta-env does not escape all interpolated values correctly; specifically, nested single quotes in a dotenv key-value; e.g.:
— both of which are valid dotenv variables.
When running those values through the
import-meta-env
CLI util, we'd get the following (invalid JSON string):The unescaped single-quotes invalidate the JSON string☹️
My team has worked around this locally — i.e. by treating invalid JavaScript as text, slicing off the JSON.stringify('') wrapper, and parsing it in a separate script so that the syntax is valid — but we wanted to raise this issue upstream and propose a fix.
There is an outstanding question about how we might want to handle single-quotes in the alternate RegExp conditions (via
createScriptPlaceholderRegExp
), so I'd be happy to extend this PR further to account for those situations.