Skip to content

fix: quote and escape environment variable values#4140

Open
rgdcastro wants to merge 1 commit intoDokploy:canaryfrom
rgdcastro:fix/env-with-spaces
Open

fix: quote and escape environment variable values#4140
rgdcastro wants to merge 1 commit intoDokploy:canaryfrom
rgdcastro:fix/env-with-spaces

Conversation

@rgdcastro
Copy link
Copy Markdown

@rgdcastro rgdcastro commented Apr 3, 2026

Ensure environment variables containing spaces or special characters are correctly handled in generated .env files by quoting and escaping values.

What is this PR about?

When deploying a service with Docker build type, environment variable values containing spaces (e.g., APP_NAME=This is an awesome app) cause the build to fail with Failed to parse dotenv file. Encountered unexpected whitespace.

This happens because values are written to .env files unquoted, and manually adding quotes in the UI doesn't help since dotenv.parse() strips them before writing.

This PR adds a quoteEnvValue() helper that
wraps values in double quotes with proper escaping of \ and " when generating .env files, applied to both Dockerfile and Docker Compose build paths.

Issues related

Fixes #4137

Greptile Summary

This PR adds a quoteDotenvValue helper that wraps .env values in double quotes with proper \ and " escaping, and applies it to both the Dockerfile and Docker Compose build paths. The fix correctly addresses the whitespace parse error by ensuring values with spaces are quoted before being written to .env files. The escaping order (backslashes before double quotes) is correct, and since prepareEnvironmentVariables runs dotenv.parse() first, any user-supplied quotes are already stripped — so double-quoting is not a concern.

Confidence Score: 5/5

Safe to merge — the fix correctly handles the primary issue and doesn't introduce regressions.

All findings are P2. The one flagged edge case (literal newlines in values producing multi-line entries) requires an unusual combination of circumstances and most parsers handle it fine. The core logic is sound.

No files require special attention.

Reviews (1): Last reviewed commit: "fix: quote and escape environment variab..." | Re-trigger Greptile

Greptile also left 1 inline comment on this PR.

(2/5) Greptile learns from your feedback when you react with thumbs up/down!

Ensure environment variables containing spaces or special characters are correctly handled in generated .env files by quoting and escaping values.
@rgdcastro rgdcastro requested a review from Siumauricio as a code owner April 3, 2026 23:06
@dosubot dosubot bot added size:S This PR changes 10-29 lines, ignoring generated files. bug Something isn't working labels Apr 3, 2026
export const quoteDotenvValue = (pair: string): string => {
const i = pair.indexOf("=");
if (i === -1) return pair;
const value = pair.substring(i + 1).replace(/\\/g, "\\\\").replace(/"/g, '\\"');
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Newline characters not escaped in quoted values

If a value contains an actual newline character (which happens when dotenv.parse() expands a \n escape sequence from a double-quoted entry in the UI), quoteDotenvValue will embed it literally, producing a multi-line entry in the .env file. While many parsers accept this, some stricter Docker tooling may not. Adding \n\\n (and \r\\r) escaping would keep every variable on a single line.

Suggested change
const value = pair.substring(i + 1).replace(/\\/g, "\\\\").replace(/"/g, '\\"');
const value = pair.substring(i + 1).replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r");

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working size:S This PR changes 10-29 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Unable to parse environment variable value with space

1 participant