fix: quote and escape environment variable values#4140
Open
rgdcastro wants to merge 1 commit intoDokploy:canaryfrom
Open
fix: quote and escape environment variable values#4140rgdcastro wants to merge 1 commit intoDokploy:canaryfrom
rgdcastro wants to merge 1 commit intoDokploy:canaryfrom
Conversation
Ensure environment variables containing spaces or special characters are correctly handled in generated .env files by quoting and escaping values.
| export const quoteDotenvValue = (pair: string): string => { | ||
| const i = pair.indexOf("="); | ||
| if (i === -1) return pair; | ||
| const value = pair.substring(i + 1).replace(/\\/g, "\\\\").replace(/"/g, '\\"'); |
Contributor
There was a problem hiding this comment.
Newline characters not escaped in quoted values
If a value contains an actual newline character (which happens when dotenv.parse() expands a \n escape sequence from a double-quoted entry in the UI), quoteDotenvValue will embed it literally, producing a multi-line entry in the .env file. While many parsers accept this, some stricter Docker tooling may not. Adding \n → \\n (and \r → \\r) escaping would keep every variable on a single line.
Suggested change
| const value = pair.substring(i + 1).replace(/\\/g, "\\\\").replace(/"/g, '\\"'); | |
| const value = pair.substring(i + 1).replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r"); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ensure environment variables containing spaces or special characters are correctly handled in generated .env files by quoting and escaping values.
What is this PR about?
When deploying a service with Docker build type, environment variable values containing spaces (e.g.,
APP_NAME=This is an awesome app) cause the build to fail withFailed to parse dotenv file. Encountered unexpected whitespace.This happens because values are written to
.envfiles unquoted, and manually adding quotes in the UI doesn't help since dotenv.parse() strips them before writing.This PR adds a
quoteEnvValue()helper thatwraps values in double quotes with proper escaping of
\and"when generating.envfiles, applied to both Dockerfile and Docker Compose build paths.Issues related
Fixes #4137
Greptile Summary
This PR adds a
quoteDotenvValuehelper that wraps.envvalues in double quotes with proper\and"escaping, and applies it to both the Dockerfile and Docker Compose build paths. The fix correctly addresses the whitespace parse error by ensuring values with spaces are quoted before being written to.envfiles. The escaping order (backslashes before double quotes) is correct, and sinceprepareEnvironmentVariablesrunsdotenv.parse()first, any user-supplied quotes are already stripped — so double-quoting is not a concern.Confidence Score: 5/5
Safe to merge — the fix correctly handles the primary issue and doesn't introduce regressions.
All findings are P2. The one flagged edge case (literal newlines in values producing multi-line entries) requires an unusual combination of circumstances and most parsers handle it fine. The core logic is sound.
No files require special attention.
Reviews (1): Last reviewed commit: "fix: quote and escape environment variab..." | Re-trigger Greptile
(2/5) Greptile learns from your feedback when you react with thumbs up/down!