fix: check input on stringify

relates google/zx#1093
webpod · Feb 1, 2025 · 093e4f3 · 093e4f3
1 parent cca6f73
commit 093e4f3
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/src/main/ts/envapi.ts b/src/main/ts/envapi.ts
@@ -73,6 +73,7 @@ const formatValue = (v: string): string => {
   if (!q1 && !q2 && !q3 && !s) return v
   if (!q1) return `${Q1}${v}${Q1}`
   if (!q2) return `${Q2}${v}${Q2}`
+  if (parse(`V=${Q3}${v}${Q3}`).V !== v) throw new Error(`Invalid value: ${v}`)
   return `${Q3}${v}${Q3}`
 }
 

diff --git a/src/test/ts/index.test.ts b/src/test/ts/index.test.ts
@@ -71,6 +71,14 @@ JSONSTR='{"foo": "b a r"}'`
 )
   })
 
+  test('stringify checks invalid (imbalanced quote) values', () => {
+    const V1 = "en_US\"'`\nBASH_ENV=$(id 1>&2)\nx=`"
+    const V2 = 'foo=\'bar\'\nbaz=\\`"qux\\`\"\"'
+
+    assert.throws(() => stringify({ V1 }))
+    assert.throws(() => stringify({ V2 }))
+  })
+
   test('accepts buffer input', () => {
     const str = 'FOO=BAR\r\nBAz=QUZ'
     const env = {