fix(codersdk): reject trailing data after closing single quote in env import#27474
Open
dylanhuff-at-coder wants to merge 1 commit into
Open
fix(codersdk): reject trailing data after closing single quote in env import#27474dylanhuff-at-coder wants to merge 1 commit into
dylanhuff-at-coder wants to merge 1 commit into
Conversation
… import The single-quoted value path of the dotenv parser previously trimmed trailing whitespace and stripped the first and last characters, so values like KEY='abc' # 'note' or KEY='a'b' silently swallowed data after the first closing quote, and KEY='abc' extra reported a misleading missing-quote error. The parser now scans for the first closing single quote, mirroring the double-quote path: whitespace-only trailers are accepted and any other trailing data is rejected with an unexpected-data error. Flagged in review of #26724.
Contributor
Author
|
Agents generated, but I reviewed it and it looks good |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The single-quote path of the dotenv parser in
codersdk/usersecretsimport.gostripped the first and last characters of the value instead of scanning for the first closing quote the way the double-quote path does. Trailing data after a closed single-quoted value was silently folded into the secret (KEY='abc' # 'note'yieldedabc' # 'note,KEY='a'b'yieldeda'b), andKEY='abc' extrafailed with the misleading message "missing closing single quote".Replace
quotedInnerwithsingleQuotedInner, which mirrorsdoubleQuotedInner: it finds the first closing single quote, accepts only trailing whitespace after it, and reportsunexpected data after closing single quotefor anything else, keepingmissing closing single quotefor genuinely unterminated values.Follow-up to a bug flagged in review of #26724: #26724 (comment)
This PR was authored by Coder Agents on behalf of @dylanhuff-at-coder.