Skip to content

Conversation

shamrt
Copy link

@shamrt shamrt commented Jan 23, 2024

import-meta-env does not escape all interpolated values correctly; specifically, nested single quotes in a dotenv key-value; e.g.:

KEY1=['value3', 'value4']
KEY2="This has 'single quotes' inside"

— both of which are valid dotenv variables.

When running those values through the import-meta-env CLI util, we'd get the following (invalid JSON string):

<script>
  globalThis.import_meta_env = JSON.parse('{"KEY1":"['value3', 'value4']","KEY2":"This has 'single quotes' inside"}');
</script>

The unescaped single-quotes invalidate the JSON string ☹️

My team has worked around this locally — i.e. by treating invalid JavaScript as text, slicing off the JSON.stringify('') wrapper, and parsing it in a separate script so that the syntax is valid — but we wanted to raise this issue upstream and propose a fix.

There is an outstanding question about how we might want to handle single-quotes in the alternate RegExp conditions (via createScriptPlaceholderRegExp), so I'd be happy to extend this PR further to account for those situations.

@shamrt shamrt changed the title test(cli): add specificity to test labels test(cli): escape single-quotes in dotenv key-values Jan 23, 2024
@shamrt shamrt changed the title test(cli): escape single-quotes in dotenv key-values fix(cli): escape single-quotes in dotenv key-values Jan 23, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant