pax_global_header 0000666 0000000 0000000 00000000064 15257741626 0014531 g ustar 00root root 0000000 0000000 52 comment=6ecb8aa618ba6dc6c3b087fce6d7660320d2adeb
ljharb-shell-quote-2ec0702/ 0000775 0000000 0000000 00000000000 15257741626 0015557 5 ustar 00root root 0000000 0000000 ljharb-shell-quote-2ec0702/.github/ 0000775 0000000 0000000 00000000000 15257741626 0017117 5 ustar 00root root 0000000 0000000 ljharb-shell-quote-2ec0702/.github/FUNDING.yml 0000664 0000000 0000000 00000001106 15257741626 0020732 0 ustar 00root root 0000000 0000000 # These are supported funding model platforms
github: [ljharb]
patreon: # Replace with a single Patreon username
open_collective: # Replace with a single Open Collective username
ko_fi: # Replace with a single Ko-fi username
tidelift: npm/shell-quote
community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
liberapay: # Replace with a single Liberapay username
issuehunt: # Replace with a single IssueHunt username
otechie: # Replace with a single Otechie username
custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']
ljharb-shell-quote-2ec0702/.github/workflows/ 0000775 0000000 0000000 00000000000 15257741626 0021154 5 ustar 00root root 0000000 0000000 ljharb-shell-quote-2ec0702/.github/workflows/node-aught.yml 0000664 0000000 0000000 00000000533 15257741626 0023733 0 ustar 00root root 0000000 0000000 name: 'Tests: node.js < 10'
on: [pull_request, push]
permissions:
contents: read
jobs:
tests:
uses: ljharb/actions/.github/workflows/node.yml@main
with:
range: '< 10'
type: minors
command: npm run tests-only
node:
name: 'node < 10'
needs: [tests]
runs-on: ubuntu-latest
steps:
- run: true
ljharb-shell-quote-2ec0702/.github/workflows/node-pretest.yml 0000664 0000000 0000000 00000000245 15257741626 0024311 0 ustar 00root root 0000000 0000000 name: 'Tests: pretest/posttest'
on: [pull_request, push]
permissions:
contents: read
jobs:
tests:
uses: ljharb/actions/.github/workflows/pretest.yml@main
ljharb-shell-quote-2ec0702/.github/workflows/node-tens.yml 0000664 0000000 0000000 00000000547 15257741626 0023601 0 ustar 00root root 0000000 0000000 name: 'Tests: node.js 10 - 20'
on: [pull_request, push]
permissions:
contents: read
jobs:
tests:
uses: ljharb/actions/.github/workflows/node.yml@main
with:
range: '>= 10 < 20'
type: minors
command: npm run tests-only
node:
name: 'node 10 - 20'
needs: [tests]
runs-on: ubuntu-latest
steps:
- run: true
ljharb-shell-quote-2ec0702/.github/workflows/node-twenties.yml 0000664 0000000 0000000 00000000536 15257741626 0024470 0 ustar 00root root 0000000 0000000 name: 'Tests: node.js >= 20'
on: [pull_request, push]
permissions:
contents: read
jobs:
tests:
uses: ljharb/actions/.github/workflows/node.yml@main
with:
range: '>= 20'
type: minors
command: npm run tests-only
node:
name: 'node >= 20'
needs: [tests]
runs-on: ubuntu-latest
steps:
- run: true
ljharb-shell-quote-2ec0702/.github/workflows/nodejs.yml 0000664 0000000 0000000 00000011432 15257741626 0023162 0 ustar 00root root 0000000 0000000 name: Node CI
on: [push, pull_request]
permissions:
contents: read
cache-mode: none
jobs:
matrix:
runs-on: ubuntu-latest
outputs:
latest: ${{ steps.set-matrix.outputs.requireds }}
nonlatest: ${{ steps.set-matrix.outputs.optionals }}
steps:
- uses: ljharb/actions/node/matrix@main
id: set-matrix
with:
versionsAsRoot: true
type: majors
preset: ">= 0.8"
latest:
needs: [matrix]
name: 'latest majors'
strategy:
fail-fast: false
matrix:
os: [windows-latest, macos-latest]
node-version: ${{ fromJson(needs.matrix.outputs.latest) }}
exclude:
- os: windows-latest
node-version: '3'
- os: windows-latest
node-version: '2'
- os: windows-latest
node-version: '1'
- os: windows-latest
node-version: '0.8'
runs-on: ${{matrix.os}}
steps:
- uses: actions/checkout@v3
- name: install rosetta
run: softwareupdate --install-rosetta --agree-to-license
if: matrix.os == 'macos-latest'
- uses: ljharb/actions/node/install@main
name: 'nvm install ${{ matrix.node-version }} && npm install'
with:
node-version: ${{ matrix.node-version }}
skip-ls-check: true
if: matrix.os != 'windows-latest'
# node 7's bundled npm 4.2.0 can neither self-upgrade (`Cannot read
# property 'path' of null`) nor TLS-handshake with the current registry
# (EPROTO); node 5 segfaults in the `prepublish` lifecycle. Deps are pure
# JS, so a modern Node installs them; the target Node only runs the tests.
- name: 'install deps with modern Node (Windows + node 5/7)'
uses: actions/setup-node@v3
with:
node-version: 22
if: ${{ matrix.os == 'windows-latest' && (matrix.node-version == '5' || matrix.node-version == '7') }}
- name: 'npm install --ignore-scripts (Windows + node 5/7)'
run: npm install --ignore-scripts
env:
NPM_CONFIG_STRICT_SSL: false
if: ${{ matrix.os == 'windows-latest' && (matrix.node-version == '5' || matrix.node-version == '7') }}
- name: Use Node.js ${{ matrix.node-version }}
uses: actions/setup-node@v3
with:
node-version: ${{ matrix.node-version }}
if: matrix.os == 'windows-latest'
- name: upgrade npm
run: npm install -g npm@6
env:
NPM_CONFIG_STRICT_SSL: false
if: matrix.os == 'windows-latest' && matrix.node-version >= 6 && matrix.node-version <= 9 && matrix.node-version != '7'
continue-on-error: true
- name: 'npm install (Windows + node 4/6: drop eslint first; npm 2/3 cannot stage eslint''s nested @types/estree, and eslint is not run in this job)'
run: |
node -e "var fs=require('fs'); var p=JSON.parse(fs.readFileSync('package.json','utf8')); delete p.devDependencies.eslint; delete p.devDependencies['@ljharb/eslint-config']; delete p.devDependencies.jiti; fs.writeFileSync('package.json',JSON.stringify(p,null,2));"
npm install
shell: bash
env:
NPM_CONFIG_STRICT_SSL: false
if: ${{ matrix.os == 'windows-latest' && (matrix.node-version == '4' || matrix.node-version == '6') }}
- run: npm install
env:
NPM_CONFIG_STRICT_SSL: false
if: ${{ matrix.os == 'windows-latest' && matrix.node-version != '4' && matrix.node-version != '5' && matrix.node-version != '6' && matrix.node-version != '7' }}
- run: ./node_modules/.bin/tape 'test/**/*.js'
- uses: codecov/codecov-action@v3
nonlatest:
needs: [matrix, latest]
name: 'non-latest majors'
continue-on-error: true
if: ${{ needs.matrix.outputs.nonlatest != '[]' && (!github.head_ref || !startsWith(github.head_ref, 'renovate')) }}
strategy:
fail-fast: false
matrix:
os: [windows-latest, macos-latest]
node-version: ${{ fromJson(needs.matrix.outputs.nonlatest) }}
exclude:
- os: windows-latest
node-version: '0.8'
runs-on: ${{matrix.os}}
steps:
- uses: actions/checkout@v3
- uses: ljharb/actions/node/install@main
name: 'nvm install ${{ matrix.node-version }} && npm install'
with:
node-version: ${{ matrix.node-version }}
skip-ls-check: true
if: matrix.os != 'windows-latest'
- name: Use Node.js ${{ matrix.node-version }}
uses: actions/setup-node@v3
with:
node-version: ${{ matrix.node-version }}
if: matrix.os == 'windows-latest'
- run: npm install
env:
NPM_CONFIG_STRICT_SSL: false
if: matrix.os == 'windows-latest'
- run: ./node_modules/.bin/tape 'test/**/*.js'
- uses: codecov/codecov-action@v3
node:
name: 'node majors, windows/mac'
needs: [latest, nonlatest]
runs-on: ubuntu-latest
steps:
- run: true
ljharb-shell-quote-2ec0702/.github/workflows/rebase.yml 0000664 0000000 0000000 00000000473 15257741626 0023144 0 ustar 00root root 0000000 0000000 name: Automatic Rebase
on: [pull_request_target]
permissions:
contents: write # for ljharb/rebase to push code to rebase
pull-requests: read # for ljharb/rebase to get info about PR
jobs:
_:
uses: ljharb/actions/.github/workflows/rebase.yml@main
secrets:
token: ${{ secrets.GITHUB_TOKEN }}
ljharb-shell-quote-2ec0702/.github/workflows/require-allow-edits.yml 0000664 0000000 0000000 00000000537 15257741626 0025602 0 ustar 00root root 0000000 0000000 name: Require “Allow Edits”
on: [pull_request_target]
permissions:
contents: read
cache-mode: none
jobs:
_:
permissions:
pull-requests: read # for ljharb/require-allow-edits to check 'allow edits' on PR
name: "Require “Allow Edits”"
runs-on: ubuntu-latest
steps:
- uses: ljharb/require-allow-edits@main
ljharb-shell-quote-2ec0702/.gitignore 0000664 0000000 0000000 00000000221 15257741626 0017542 0 ustar 00root root 0000000 0000000 # gitignore
node_modules
coverage/
.nyc_output/
# Only apps should have lockfiles
npm-shrinkwrap.json
package-lock.json
yarn.lock
.npmignore
ljharb-shell-quote-2ec0702/.npmrc 0000664 0000000 0000000 00000000067 15257741626 0016702 0 ustar 00root root 0000000 0000000 package-lock=false
allow-same-version=true
message=v%s
ljharb-shell-quote-2ec0702/.nycrc 0000664 0000000 0000000 00000000345 15257741626 0016700 0 ustar 00root root 0000000 0000000 {
"all": true,
"check-coverage": false,
"reporter": ["text-summary", "text", "html", "json"],
"lines": 86,
"statements": 85.93,
"functions": 82.43,
"branches": 76.06,
"exclude": [
"coverage",
"example",
"test"
]
}
ljharb-shell-quote-2ec0702/CHANGELOG.md 0000664 0000000 0000000 00000100632 15257741626 0017372 0 ustar 00root root 0000000 0000000 # Changelog
All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
## [v1.12.0](https://github.com/ljharb/shell-quote/compare/v1.11.0...v1.12.0) - 2026-10-02
### Fixed
- [New] `parse`: support here-documents (`<<`) [`#31`](https://github.com/ljharb/shell-quote/issues/31)
### Commits
- [New] `parse`: support tab-stripping here-documents (`<<-`) [`dbfac37`](https://github.com/ljharb/shell-quote/commit/dbfac376d4065d37539d3abdb5e76847f93797d3)
- [New] `parse`: support output process substitution (`>(`) [`2053315`](https://github.com/ljharb/shell-quote/commit/20533154bb57809c80f55318b8493aef49505f4e)
- [New] `parse`: support the `case` test-next terminator (`;;&`) [`7d688b9`](https://github.com/ljharb/shell-quote/commit/7d688b9bec1917a22cccd4d4c887128a9c66e8a0)
- [New] `parse`: support the `case` fall-through terminator (`;&`) [`f27010e`](https://github.com/ljharb/shell-quote/commit/f27010ed04bcd925795b350afb1c49e36bbd1ba3)
- [New] `parse`: support redirecting output despite `noclobber` (`>|`) [`b78d19c`](https://github.com/ljharb/shell-quote/commit/b78d19c14da6356cc12c46b3478203247ab8a295)
- [New] `parse`: support opening a file for reading and writing (`<>`) [`21cc333`](https://github.com/ljharb/shell-quote/commit/21cc333eb0ce5bf094f595b7fdc01b3447ffd4b0)
- [New] `parse`: support redirecting stdout and stderr (`&>`) [`6ad6cd2`](https://github.com/ljharb/shell-quote/commit/6ad6cd215f89adcc29dd601e085fa54083c2f911)
- [New] `parse`: support appending stdout and stderr (`&>>`) [`90cde9c`](https://github.com/ljharb/shell-quote/commit/90cde9cfd8af30fcb65e9fd2cb2f9e181d3f103b)
- [Dev Deps] update `@ljharb/eslint-config` [`3a7b4ae`](https://github.com/ljharb/shell-quote/commit/3a7b4ae3960c3ff4413932e276c5b0ecb3a2b456)
## [v1.11.0](https://github.com/ljharb/shell-quote/compare/v1.10.0...v1.11.0) - 2026-09-29
### Fixed
- [Refactor] `quote`: drop a replace that can never match in the single-quote branch [`#15`](https://github.com/ljharb/shell-quote/issues/15)
- [New] `parse`: support bash ANSI-C quoting (`$'...'`) [`#32`](https://github.com/ljharb/shell-quote/issues/32)
### Commits
- [Fix] `quote`: reject line terminators in tokens after a `comment` [`6002b2e`](https://github.com/ljharb/shell-quote/commit/6002b2ed90c6b83095eb272b6b0adaf3a172b0bc)
- [Fix] `parse`: preserve text after special shell parameters [`81b08a5`](https://github.com/ljharb/shell-quote/commit/81b08a532e898a3627f9305fa13d643ffa82a9d3)
- [Fix] `parse`: an escaped backslash does not escape the character after it [`d708019`](https://github.com/ljharb/shell-quote/commit/d708019016ce26e1a8a05af4b296e35ef8095c9e)
- [Fix] `quote`: preserve `!` in arguments that also contain `'` [`ad39927`](https://github.com/ljharb/shell-quote/commit/ad399279dbbbd086967d2040c1558b4888b074e6)
- [Fix] `parse`: treat `$_name` as a variable name, not `$_` followed by text [`28f88cd`](https://github.com/ljharb/shell-quote/commit/28f88cd422ae4046aca9556c4b74ca90b0ea7f6b)
- [Fix] `quote`: preserve empty glob patterns [`35c9b97`](https://github.com/ljharb/shell-quote/commit/35c9b97a744211091b772f145bef0b6a5562b68e)
- [Fix] `quote`: escape `~` in glob patterns to prevent shell tilde-expansion [`239d49c`](https://github.com/ljharb/shell-quote/commit/239d49cae6d231436ea4e676850037018c790c49)
- [Dev Deps] update `@ljharb/eslint-config`, `auto-changelog`, `eslint`, `evalmd` [`b1e406e`](https://github.com/ljharb/shell-quote/commit/b1e406ed4287a134cc649db47b9a59e21b304472)
- [meta] npmignore some files [`ebfc308`](https://github.com/ljharb/shell-quote/commit/ebfc3080cf5f68db5edfddfba49dc8c4ccacd2d5)
- [actions] add permissions [`3429b0d`](https://github.com/ljharb/shell-quote/commit/3429b0d349211786765e9e68478e029d96ad44e9)
- [actions] set least-privilege `cache-mode` [`36f2394`](https://github.com/ljharb/shell-quote/commit/36f23944db50dd3f0df4da9c7cba0bb63df05f64)
- [Dev Deps] update `eslint` [`6de9a41`](https://github.com/ljharb/shell-quote/commit/6de9a41ecfc4fe9f9546df08866c8ead039f8909)
## [v1.10.0](https://github.com/ljharb/shell-quote/compare/v1.9.0...v1.10.0) - 2026-07-10
### Merged
- [New] `parse`: add opt-in `splitUnquoted` option for shell field-splitting of unquoted expansions [`#1`](https://github.com/ljharb/shell-quote/pull/1)
### Commits
- [Fix] `parse`: match nested `${...}` braces so nested parameter expansion is consumed as one substitution [`c0842c8`](https://github.com/ljharb/shell-quote/commit/c0842c8a7a034066da2496a75e91cbe500ff736c)
- [Tests] `parse`: pin single-quote literalness and unmatched-quote handling [`a0d03e3`](https://github.com/ljharb/shell-quote/commit/a0d03e35c8ede24016502c4433b8f5d6b3100a62)
- [readme] remove the space in js code fences so evalmd evaluates them [`2116fa3`](https://github.com/ljharb/shell-quote/commit/2116fa36aeea77fe8d561b0db46b1f9b26b8cf1b)
- [Tests] `quote`: pin conservative escaping of `=`, `@`, `^`, `,`, `:`, `!` (#11) [`1c36f3f`](https://github.com/ljharb/shell-quote/commit/1c36f3ff77d26d200620c1027e5c271050120b8e)
- [readme] document that `quote` outputs POSIX quoting, not `cmd.exe`/PowerShell [`100e96e`](https://github.com/ljharb/shell-quote/commit/100e96e0ffadcca97d63dda15651c70b9f83507c)
- [readme] document `parse`'s supported parameter-expansion subset [`e1c75cd`](https://github.com/ljharb/shell-quote/commit/e1c75cd6e4a3c60003792c7f2802587d328622cb)
- [Fix] `parse`: a backslash inside single quotes must not escape the closing quote [`5d460a3`](https://github.com/ljharb/shell-quote/commit/5d460a332b54b83153297fe7d1964330b28fa491)
- [readme] fix stale example outputs [`2de86f5`](https://github.com/ljharb/shell-quote/commit/2de86f5d44f44d3ac9df36413d8a05f3534cdec6)
- [Tests] `quote`: pin that a backslash with whitespace is not doubled in single quotes (#14) [`190e236`](https://github.com/ljharb/shell-quote/commit/190e236bcf1d81caa8e40e8ea3bb11998575be71)
- [readme] `quote`: use output verbatim; do not re-quote it (#11) [`1b36468`](https://github.com/ljharb/shell-quote/commit/1b364683b1e9e8d078fd3017cde82cf10c9c04a5)
- [Refactor] `parse`: fix swapped `SINGLE_QUOTE`/`DOUBLE_QUOTE` variable names [`801af5c`](https://github.com/ljharb/shell-quote/commit/801af5c935b27d6dcda63b3975d5e92a7b6f887f)
- [types] fix an error TS v6 ignores but v7 fails on [`59bbf8b`](https://github.com/ljharb/shell-quote/commit/59bbf8b81bf3236842deb72805744d489f650eba)
- [Dev Deps] update `@arethetypeswrong/cli`, `evalmd` [`a04d475`](https://github.com/ljharb/shell-quote/commit/a04d47516e1cd5b1b4d3f720ddf97561ed0082fc)
- [Dev Deps] update `@arethetypeswrong/ci`, `eslint` [`d390f9a`](https://github.com/ljharb/shell-quote/commit/d390f9a92b97a04b1f799298634e90dc581021e6)
- [Tests] `quote`: the tilde test escapes every `~`, not just a leading one (#9) [`617d119`](https://github.com/ljharb/shell-quote/commit/617d119795c7b44d6e49a4d41f80195c4aa5735c)
## [v1.9.0](https://github.com/ljharb/shell-quote/compare/v1.8.4...v1.9.0) - 2026-06-24
### Commits
- [New] add types [`dca6e21`](https://github.com/ljharb/shell-quote/commit/dca6e21a02df4cc1a83ed1b5baa4d82df134170a)
- [Dev Deps] update `eslint` [`9aa9e8f`](https://github.com/ljharb/shell-quote/commit/9aa9e8f60991f8c4053a29e476795d891ff851ad)
- [Fix] `parse`: finalize tokens in linear time (GHSA-395f-4hp3-45gv) [`7ff5488`](https://github.com/ljharb/shell-quote/commit/7ff5488599d01c323514f02f5efb74088dd134ec)
- [actions] update workflows [`75e8497`](https://github.com/ljharb/shell-quote/commit/75e849741ffaf2d3aa53ae0e18ef6bf9929ef478)
- [actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10`@types/esrecurse` [`3fb739d`](https://github.com/ljharb/shell-quote/commit/3fb739de44b81c69431947d54fbfc18998dd6d72)
- [actions] retry `npm install` on Windows to survive npm 2/3 staging-rename flake [`abe0163`](https://github.com/ljharb/shell-quote/commit/abe0163293c82963fa8a16cfaa87181846d5aced)
- [actions] Windows + node 5/7: install deps with a modern node [`b4bafa2`](https://github.com/ljharb/shell-quote/commit/b4bafa2e7e58d53d9839b1c24976f61e54b43326)
- [Fix] `quote`: escape leading `~` to prevent shell tilde-expansion [`7a76c1a`](https://github.com/ljharb/shell-quote/commit/7a76c1a12d8461c2234a1c655b943cee84cbff91)
- [Dev Deps] update `auto-changelog`, `tape` [`7184b44`](https://github.com/ljharb/shell-quote/commit/7184b4458b65c17b931e126d8cb5f586c6717dc8)
- [Dev Deps] apparently `jackspeak` is no longer in the graph [`9ba368a`](https://github.com/ljharb/shell-quote/commit/9ba368a4057b9f498b0fef23b5b15543ef81b98c)
## [v1.8.4](https://github.com/ljharb/shell-quote/compare/v1.8.3...v1.8.4) - 2026-05-22
### Commits
- [Fix] `quote`: validate object-token shapes [`4378a6e`](https://github.com/ljharb/shell-quote/commit/4378a6e613db5948168684864e49b42b83134d2d)
- [Dev Deps] update `@ljharb/eslint-config`, `auto-changelog`, `eslint`, `npmignore` [`22ebec0`](https://github.com/ljharb/shell-quote/commit/22ebec04349065a45ad8afc8cc8d53c4624634a6)
- [Tests] increase coverage [`9f3caa3`](https://github.com/ljharb/shell-quote/commit/9f3caa31900cc6ee64858b31134144c648ce206d)
- [readme] replace runkit CI badge with shields.io check-runs badge [`3344a04`](https://github.com/ljharb/shell-quote/commit/3344a047dd1e95f71c4ca27522cbfd05c56277e0)
- [Dev Deps] update `@ljharb/eslint-config` [`699c511`](https://github.com/ljharb/shell-quote/commit/699c5113d135f4d4591574bebf173334ffa453d4)
## [v1.8.3](https://github.com/ljharb/shell-quote/compare/v1.8.2...v1.8.3) - 2025-06-01
### Fixed
- [Fix] remove unnecessary backslash escaping in single quotes [`#15`](https://github.com/ljharb/shell-quote/issues/15)
## [v1.8.2](https://github.com/ljharb/shell-quote/compare/v1.8.1...v1.8.2) - 2024-11-27
### Fixed
- [Fix] `quote`: preserve empty strings [`#18`](https://github.com/ljharb/shell-quote/issues/18)
### Commits
- [meta] fix changelog tags [`0fb9fd8`](https://github.com/ljharb/shell-quote/commit/0fb9fd8441aa06f7de995e90ce85bd9e758f5f05)
- [actions] split out node 10-20, and 20+ [`819bd84`](https://github.com/ljharb/shell-quote/commit/819bd842e0b01f3e5041834ab82bad299851de08)
- [Dev Deps] update `@ljharb/eslint-config`, `auto-changelog`, `npmignore`, `tape` [`fc56408`](https://github.com/ljharb/shell-quote/commit/fc564086c83317363908b55f6c744ad35983ccca)
- [actions] update npm for windows tests [`fdeb0fd`](https://github.com/ljharb/shell-quote/commit/fdeb0fd102ecdd4ff227a978532598c462312347)
- [Dev Deps] update `@ljharb/eslint-config`, `aud`, `tape` [`b8a4a3b`](https://github.com/ljharb/shell-quote/commit/b8a4a3b3f5ae3ca8ae86b89ed0030e4e3358ef3c)
- [actions] prevent node 14 on ARM mac from failing [`9eecafc`](https://github.com/ljharb/shell-quote/commit/9eecafc0486c9321be223415cf3fb76a5bd07dda)
- [meta] exclude more files from the package [`4044e7f`](https://github.com/ljharb/shell-quote/commit/4044e7fad4a45e696602060b69b31a95702bee28)
- [Tests] replace `aud` with `npm audit` [`8cfdbd8`](https://github.com/ljharb/shell-quote/commit/8cfdbd8ec30e653f9f99348e59117ed4a789e1ba)
- [meta] add missing `engines.node` [`843820e`](https://github.com/ljharb/shell-quote/commit/843820e1a46cebcf10d8e48c4d82d0ab5a7b0194)
- [Dev Deps] add missing peer dep [`4c3b88d`](https://github.com/ljharb/shell-quote/commit/4c3b88d7925d29e9cc1ac76ccde05f4e714ede96)
- [Dev Deps] pin `jackspeak` since 2.1.2+ depends on npm aliases, which kill the install process in npm < 6 [`80322ed`](https://github.com/ljharb/shell-quote/commit/80322ed5914a5922d9507946490fbabcc96e624b)
## [v1.8.1](https://github.com/ljharb/shell-quote/compare/v1.8.0...v1.8.1) - 2023-04-07
### Fixed
- [Fix] `parse`: preserve whitespace in comments [`#6`](https://github.com/ljharb/shell-quote/issues/6)
- [Fix] properly support the `escape` option [`#5`](https://github.com/ljharb/shell-quote/issues/5)
### Commits
- [Refactor] `parse`: hoist `getVar` to module level [`b42ac73`](https://github.com/ljharb/shell-quote/commit/b42ac73e39e566cfc355a4addc4bd2df2652556c)
- [Refactor] hoist some vars to module level [`8f0c5c3`](https://github.com/ljharb/shell-quote/commit/8f0c5c3c9df3a10e32f1972636675af6fffef998)
- [Refactor] `parse`: use `slice` over `substr`, cache some values [`fcb2e1a`](https://github.com/ljharb/shell-quote/commit/fcb2e1acd5312a1a1a4e6c66ec688aab383023b5)
- [Refactor] `parse`: a bit of cleanup [`6780ec5`](https://github.com/ljharb/shell-quote/commit/6780ec5194e36e2a696bfbaaf85169682a333321)
- [Refactor] `parse`: tweak the regex to not match nothing [`227d474`](https://github.com/ljharb/shell-quote/commit/227d4742a006e81ec3fde1eee103731a6f7ea920)
- [Tests] increase coverage [`a66de94`](https://github.com/ljharb/shell-quote/commit/a66de943555e49fbb1b657cbe3c5b2c703ae507d)
- [Refactor] `parse`: avoid shadowing a function arg [`1d58679`](https://github.com/ljharb/shell-quote/commit/1d5867907ecbf553556fe6ad790b6d6658aedba3)
## [v1.8.0](https://github.com/ljharb/shell-quote/compare/v1.7.4...v1.8.0) - 2023-01-30
### Commits
- [New] extract `parse` and `quote` to their own deep imports [`553fdfc`](https://github.com/ljharb/shell-quote/commit/553fdfc32cc41b4c2f77e061b6957703958ca575)
- [Tests] add `nyc` coverage [`fd7ddcd`](https://github.com/ljharb/shell-quote/commit/fd7ddcdd84bfef064c6d9a06b055a95531b26897)
- [New] Add support for here strings (`<<<`) [`9802fb3`](https://github.com/ljharb/shell-quote/commit/9802fb37c7946e18c672b81122520dc296bde271)
- [New] `parse`: Add syntax support for duplicating input file descriptors [`216b198`](https://github.com/ljharb/shell-quote/commit/216b19894f76b14d164c4c5a68f05a51b06336c4)
- [Dev Deps] update `@ljharb/eslint-config`, `aud`, `tape` [`85f8e31`](https://github.com/ljharb/shell-quote/commit/85f8e31dd80e1dde63d58204b653e497a53857e6)
- [Tests] add `evalmd` [`c5549fc`](https://github.com/ljharb/shell-quote/commit/c5549fcd82d70046bdc2b1c34184ae9f9d0191f9)
- [actions] update checkout action [`62e9b49`](https://github.com/ljharb/shell-quote/commit/62e9b4958cfa2f9009b7069076612fe33528c1fb)
## [v1.7.4](https://github.com/ljharb/shell-quote/compare/v1.7.3...v1.7.4) - 2022-10-12
### Merged
- Add node_modules to .gitignore [`#48`](https://github.com/ljharb/shell-quote/pull/48)
### Commits
- [eslint] fix indentation and whitespace [`aaa9d1f`](https://github.com/ljharb/shell-quote/commit/aaa9d1f65bf3445e6af1efaa4a8f8c13a21aa593)
- [eslint] additional cleanup [`397cb62`](https://github.com/ljharb/shell-quote/commit/397cb628f3d96e4e47763147c0d6074997a13880)
- [meta] add `auto-changelog` [`497fca5`](https://github.com/ljharb/shell-quote/commit/497fca509af3b7d6daaba459bad1f45ac0af3ff1)
- [actions] add reusable workflows [`4763c36`](https://github.com/ljharb/shell-quote/commit/4763c36274c5881a2d141ce9f2b17b7d1d95e8cd)
- [eslint] add eslint [`6ee1437`](https://github.com/ljharb/shell-quote/commit/6ee1437df1b10a79bdf2aaa04f2bacc9f420dc15)
- [readme] rename, add badges [`7eb5134`](https://github.com/ljharb/shell-quote/commit/7eb513483d931602452ec572ed456714148acd2b)
- [meta] update URLs [`67381b6`](https://github.com/ljharb/shell-quote/commit/67381b61fa95e57819333463f491428747893186)
- [meta] create FUNDING.yml; add `funding` in package.json [`8641572`](https://github.com/ljharb/shell-quote/commit/86415722d875578adf1f95f9e649ba42c805bc32)
- [meta] use `npmignore` to autogenerate an npmignore file [`2e2007a`](https://github.com/ljharb/shell-quote/commit/2e2007a393f90bf079fc556a921120b3508c4fc3)
- Only apps should have lockfiles [`f97411e`](https://github.com/ljharb/shell-quote/commit/f97411ef4d2f183200fc8a28beca9faf9b08a640)
- [Dev Deps] update `tape` [`051f608`](https://github.com/ljharb/shell-quote/commit/051f60857ad5035280208abdc348bf5ba42a6254)
- [meta] add `safe-publish-latest` [`18cadf9`](https://github.com/ljharb/shell-quote/commit/18cadf95357392fcd78ea8619956fd41eed62649)
- [Tests] add `aud` in `posttest` [`dc1cc12`](https://github.com/ljharb/shell-quote/commit/dc1cc12b956ccd93d58aaaad263bee7d50576d27)
## [v1.7.3](https://github.com/ljharb/shell-quote/compare/v1.7.2...v1.7.3) - 2021-10-20
* Fix a security issue where the regex for windows drive letters allowed some shell meta-characters
to escape the quoting rules. (CVE-2021-42740)
## [v1.7.2](https://github.com/ljharb/shell-quote/compare/v1.7.1...v1.7.2) - 2019-08-30
* Fix a regression introduced in 1.6.3. This reverts the Windows path quoting fix. ([144e1c2](https://github.com/ljharb/shell-quote/commit/144e1c20cd57549a414c827fb3032e60b7b8721c))
## [v1.7.1](https://github.com/ljharb/shell-quote/compare/v1.7.0...v1.7.1) - 2019-08-13
* Fix `$` being removed when not part of an environment variable name. ([@Adman](https://github.com/Admin) in [#32](https://github.com/ljharb/shell-quote/pull/32))
## [v1.7.0](https://github.com/ljharb/shell-quote/compare/v1.6.3...v1.7.0) - 2019-08-13
* Add support for parsing `>>` and `>&` redirection operators. ([@forivall](https://github.com/forivall) in [#16](https://github.com/ljharb/shell-quote/pull/16))
* Add support for parsing `<(` process substitution operator. ([@cuonglm](https://github.com/cuonglm) in [#15](https://github.com/ljharb/shell-quote/pull/15))
## [v1.6.3](https://github.com/ljharb/shell-quote/compare/v1.6.2...v1.6.3) - 2019-08-13
* Fix Windows path quoting problems. ([@dy](https://github.com/dy) in [#34](https://github.com/ljharb/shell-quote/pull/34))
## [v1.6.2](https://github.com/ljharb/shell-quote/compare/v1.6.1...v1.6.2) - 2019-08-13
### Merged
- Use native JSON and Array methods [`#21`](https://github.com/ljharb/shell-quote/pull/21)
### Commits
- fix whitespace [`72fb5a8`](https://github.com/ljharb/shell-quote/commit/72fb5a8ce29b4f67f28302af33c217b58f92e260)
- Disable package-lock.json [`d450577`](https://github.com/ljharb/shell-quote/commit/d4505770b2a4251af2da8e177385c5e0456a83b6)
## [1.6.1](https://github.com/ljharb/shell-quote/compare/v1.6.0...v1.6.1) - 2016-06-17
### Commits
- Fix some more escaping for .quote() [`ace52f4`](https://github.com/ljharb/shell-quote/commit/ace52f4c8717b370b301a3db3a4727db26e309ad)
- Fix escaping for greater than and less than [`70e9eb2`](https://github.com/ljharb/shell-quote/commit/70e9eb2a854eb56a3dfa255be12610a722bbe080)
## [1.6.0](https://github.com/ljharb/shell-quote/compare/v1.5.0...v1.6.0) - 2016-04-23
### Commits
- add comment parsing feature [`b8b5c31`](https://github.com/ljharb/shell-quote/commit/b8b5c31c16a15aa4ab26c8f23d362a24b9fa57c4)
## [1.5.0](https://github.com/ljharb/shell-quote/compare/v1.4.3...v1.5.0) - 2016-03-16
### Commits
- add escape option to .parse [`4d400e7`](https://github.com/ljharb/shell-quote/commit/4d400e773be448c320b6dc9b2eb1323d7a3461ca)
## [1.4.3](https://github.com/ljharb/shell-quote/compare/v1.4.2...v1.4.3) - 2015-03-07
### Commits
- Fix quote() with special chars [`811b5a0`](https://github.com/ljharb/shell-quote/commit/811b5a0aff79f347db245edcf88750977c111844)
## [1.4.2](https://github.com/ljharb/shell-quote/compare/v1.4.1...v1.4.2) - 2014-07-20
### Commits
- Handle non-strings when quoting [`d435827`](https://github.com/ljharb/shell-quote/commit/d43582741c5599807249c28722487aa86bb16f06)
- falseys ok [`22dbd94`](https://github.com/ljharb/shell-quote/commit/22dbd9492c372038d439d6ec08c6288ca5fa3c10)
- all the falseys test [`c99dca5`](https://github.com/ljharb/shell-quote/commit/c99dca59dca64743877a0411d299ce669f0a2d1d)
## [1.4.1](https://github.com/ljharb/shell-quote/compare/v1.4.0...v1.4.1) - 2013-12-24
### Commits
- es5 shims [`00dc6ab`](https://github.com/ljharb/shell-quote/commit/00dc6abfdd2f3ff2908616dbe7b6584bbf1b0e24)
- separate shim file to get the coverage up [`e29a216`](https://github.com/ljharb/shell-quote/commit/e29a2167319913af3f26603bc33938bb9be1d74d)
- use array-{filter,map,reduce} [`97a2fc9`](https://github.com/ljharb/shell-quote/commit/97a2fc9c92917343a33662b3705860e4f2044730)
- add testling badge [`44c98b1`](https://github.com/ljharb/shell-quote/commit/44c98b1e341d348ce9b5b4d78bb4d26345e868ea)
- upgrade tape [`3fc22d3`](https://github.com/ljharb/shell-quote/commit/3fc22d3d38592e6fc3b3308cc73a282d641bad34)
## [1.4.0](https://github.com/ljharb/shell-quote/compare/v1.3.3...v1.4.0) - 2013-10-17
### Merged
- Add MIT LICENSE file [`#6`](https://github.com/ljharb/shell-quote/pull/6)
### Commits
- Rewrite parser as a character based scanner [`c7ca9a2`](https://github.com/ljharb/shell-quote/commit/c7ca9a200350c02fb86c4222b63f15b54a0a0226)
- Add tests for glob patterns [`3418892`](https://github.com/ljharb/shell-quote/commit/3418892031b126197302eb57cc92a729b740fac6)
- Update algo description [`e1442cf`](https://github.com/ljharb/shell-quote/commit/e1442cfe0521497b59a8204eb1e4d6c4202d42b9)
- Fix test case for backslash in double quotes [`89bc550`](https://github.com/ljharb/shell-quote/commit/89bc5500711643e87fe93dd1bde0e8745c34d733)
- Add failing tests for crazy quoting tricks [`58a5e48`](https://github.com/ljharb/shell-quote/commit/58a5e4800a62fdc3e980feae1e6c6b15c812f0cb)
## [1.3.3](https://github.com/ljharb/shell-quote/compare/v1.3.2...v1.3.3) - 2013-06-24
### Commits
- failing set test with an env cb [`9fb2096`](https://github.com/ljharb/shell-quote/commit/9fb20968b407c590745a982d2a562960e952142d)
- remove the broken special case [`f9a0ee5`](https://github.com/ljharb/shell-quote/commit/f9a0ee574f9d5e5d5b382f55da960c23eb7d44c5)
## [1.3.2](https://github.com/ljharb/shell-quote/compare/v1.3.1...v1.3.2) - 2013-06-24
### Commits
- tests for setting env vars [`f44b039`](https://github.com/ljharb/shell-quote/commit/f44b03906c60598470676edcabea79c4f7488407)
- fixed the parse test, broke the op tests [`74d6686`](https://github.com/ljharb/shell-quote/commit/74d66863615a60fcb222d2279991cff3a89ff015)
- factored out single and double quote regex [`de9e0a5`](https://github.com/ljharb/shell-quote/commit/de9e0a5081156e5483b5df24878c7414f90ec67e)
- updated set env test, already passes [`7d5636b`](https://github.com/ljharb/shell-quote/commit/7d5636bec5e76ff542712e07643b09c597d20b21)
- ops fixed [`2b4e1b1`](https://github.com/ljharb/shell-quote/commit/2b4e1b1fb63519456c7850d365e1ffe5fa5972b2)
- passing all tests [`44177e3`](https://github.com/ljharb/shell-quote/commit/44177e3dcbd96dfa331483eba0abbfb0291c130f)
- backreferences in negated capture groups don't actually work [`e189d9d`](https://github.com/ljharb/shell-quote/commit/e189d9d5910c6ecc7d564309ca9e110062f9589e)
- another crazy ridiculous passing parse test [`d1beb6b`](https://github.com/ljharb/shell-quote/commit/d1beb6b32ec7ad8752b305834a21c800cae74a95)
- failing test for quoted whitespace and nested quotes [`9a4c11c`](https://github.com/ljharb/shell-quote/commit/9a4c11cba0f61762aaa7887591d78fe7e965cf65)
- failing test for quotes embedded inside barewords [`d997384`](https://github.com/ljharb/shell-quote/commit/d997384018ce107ab8e12aa5b8d8359c2f77128b)
## [1.3.1](https://github.com/ljharb/shell-quote/compare/v1.3.0...v1.3.1) - 2013-05-13
### Commits
- pass objects through [`f9c0514`](https://github.com/ljharb/shell-quote/commit/f9c0514abbdf8ba16fafb68736863d14b39015ef)
## [1.3.0](https://github.com/ljharb/shell-quote/compare/v1.2.0...v1.3.0) - 2013-05-13
### Commits
- hacky tokenizer is much simpler [`7e91b18`](https://github.com/ljharb/shell-quote/commit/7e91b18d1cf3fffd6a9c5f69d785f200c0c81b66)
- nearly passing with a clunky state env parser, array issues [`d6d6416`](https://github.com/ljharb/shell-quote/commit/d6d64160f2fc8a23018410ffe84ab7f1b0c4fa02)
- test for functional env expansion [`666395f`](https://github.com/ljharb/shell-quote/commit/666395f9f195241c6077f242dc4f2851bed95f8d)
- upgrade travis versions, tape [`f6f8bd6`](https://github.com/ljharb/shell-quote/commit/f6f8bd6026375d44d40c7f2e1fead43d006be211)
- 1.3.0, document env() lookups [`041c5da`](https://github.com/ljharb/shell-quote/commit/041c5da88800b4e15f0ed023049050b11b623a23)
- first half of functional env() works [`7a0cf79`](https://github.com/ljharb/shell-quote/commit/7a0cf79987fbdcc00d8f36c6dc164d22db963d23)
- env() objects even work inside quote strings [`16139f5`](https://github.com/ljharb/shell-quote/commit/16139f52bf7a2beb7e1ca9b61b93a9ea598b0f1a)
- another check just to make sure env() works [`914a1a9`](https://github.com/ljharb/shell-quote/commit/914a1a9ec55cd76bedfed4086c35866733128036)
## [1.2.0](https://github.com/ljharb/shell-quote/compare/v1.1.0...v1.2.0) - 2013-05-13
### Commits
- failing test for special shell parameter env vars [`728862a`](https://github.com/ljharb/shell-quote/commit/728862a6ff246754083da5cf22322caf914ae990)
- add the special vars to the replace regex but the chunker breaks on them [`d1ff82a`](https://github.com/ljharb/shell-quote/commit/d1ff82a07c44cb53ab909b61833296f38257eabd)
- fixed the env test, everything is fine [`a45897f`](https://github.com/ljharb/shell-quote/commit/a45897f53ba184a77bc762c63777b95590a83962)
## [1.1.0](https://github.com/ljharb/shell-quote/compare/v1.0.0...v1.1.0) - 2013-05-13
### Commits
- quote all ops objects [`ac7be63`](https://github.com/ljharb/shell-quote/commit/ac7be63574e1da48bc6f495aee363d31863222c3)
- test for parsed ops objects in quote() [`59fb71b`](https://github.com/ljharb/shell-quote/commit/59fb71b39c53b83306d015bec62fc93667745f75)
- another test for op object quoting [`5819a31`](https://github.com/ljharb/shell-quote/commit/5819a31a19c34967dcb7bd1719250ed2aa480583)
## [1.0.0](https://github.com/ljharb/shell-quote/compare/0.1.1...v1.0.0) - 2013-05-13
### Commits
- document ops, op example [`a6381e6`](https://github.com/ljharb/shell-quote/commit/a6381e612361148a8433c6ec4891aabc4649cb40)
- some more passing double-char op tests [`fbc6e5c`](https://github.com/ljharb/shell-quote/commit/fbc6e5c40858ef4ea4d69651ac8fdf6c0c780eed)
- failing test for | and & ops [`d817736`](https://github.com/ljharb/shell-quote/commit/d81773643cbc2e25576884d606165dc87e8bbfac)
- labeled regex states [`8c008b2`](https://github.com/ljharb/shell-quote/commit/8c008b223e6174d6bec098251527053e5cc1f30c)
- refactored the chunker regex into a string [`0331c7f`](https://github.com/ljharb/shell-quote/commit/0331c7f63077fda116b3c73540b71880538a4391)
- simple failing double-char op test [`e51fa90`](https://github.com/ljharb/shell-quote/commit/e51fa90f854063a408e8c1645b385c1ed42c72c6)
- failing expanded single-op tests for ; and () [`710bb24`](https://github.com/ljharb/shell-quote/commit/710bb243f23d4a55158688b71cb56b67f66ea99f)
- now passing all the single-char op tests [`e3e9ac1`](https://github.com/ljharb/shell-quote/commit/e3e9ac17ef02300bad7f4faefee5c7a993b3bc97)
- using the control ops directly from the docs [`f535987`](https://github.com/ljharb/shell-quote/commit/f53598732ba606c7bca66fd7d55d809544c452cf)
- first part of op parsing works [`e6f9199`](https://github.com/ljharb/shell-quote/commit/e6f91991fe437eae6b7e4f571843b3d48c746aeb)
- failing redirect tests [`cb94c10`](https://github.com/ljharb/shell-quote/commit/cb94c105a4e32fac2d356b956f53aff999ae88e8)
- another double-char op test just to be sure [`5cf1bf2`](https://github.com/ljharb/shell-quote/commit/5cf1bf29e3324a6cc1e40c01c4529b28ca0b47a5)
- 1.0.0 for ops [`17a40ed`](https://github.com/ljharb/shell-quote/commit/17a40edb3cd7a0f1c44be2be5ddd412c8ca2b7ca)
- adding redirect <> ops to CONTROL makes the tests pass [`48b1eb9`](https://github.com/ljharb/shell-quote/commit/48b1eb97cfa306659de66bd29615051a3644b9ce)
- double-char op test now passing [`3998b0f`](https://github.com/ljharb/shell-quote/commit/3998b0f9ecb32883f8eb3be31110a84d276ac764)
- using the meta chars directly from the docs [`b009ef6`](https://github.com/ljharb/shell-quote/commit/b009ef6d04eb1cc57d66cf3670d24e03fa0fc6bd)
- the spec says tabs are also allowed [`2adb373`](https://github.com/ljharb/shell-quote/commit/2adb37366bdfae198ce61e4658e513d3e0bc98fa)
- op test completely passing [`20a0147`](https://github.com/ljharb/shell-quote/commit/20a01475741d9fba801bbd2b0c1a5f215dc9cec4)
## [0.1.1](https://github.com/ljharb/shell-quote/compare/0.1.0...0.1.1) - 2013-04-17
### Commits
- Return empty list when parsing an empty (or whitespace-only) string [`1475717`](https://github.com/ljharb/shell-quote/commit/14757177ead209f5ae3c9d4a3020fba9f522725f)
## [0.1.0](https://github.com/ljharb/shell-quote/compare/0.0.1...0.1.0) - 2013-04-14
### Commits
- externalize the regex declaration [`37d6058`](https://github.com/ljharb/shell-quote/commit/37d60580a4a4656ff836c4a2ecdd7282705ffd27)
- modernize the readme [`24106f5`](https://github.com/ljharb/shell-quote/commit/24106f5c81ab83bddb2bf735cad60e99e1494dcf)
- factor out interpolation [`1b21b01`](https://github.com/ljharb/shell-quote/commit/1b21b018e01392d2c74e53136f8fa0ca838d7643)
- half the env tests are working with basic interpolation [`5891471`](https://github.com/ljharb/shell-quote/commit/589147176be93834bad7fcee83bd255e35c14adc)
- env parse example [`5757c42`](https://github.com/ljharb/shell-quote/commit/5757c4256a4cbaeaabd3d8cd91c7e19109329067)
- failing tests for unimplemented env interpolation [`590534a`](https://github.com/ljharb/shell-quote/commit/590534ae8eced91974a4be8f2b6bc7dcb53e3211)
- denormalize the interpolate logic to make room for special cases [`c669d2e`](https://github.com/ljharb/shell-quote/commit/c669d2e8b84e0eb0dde1798eae7c37a21dc5b7a1)
- cleaner implementation recursing on the double quote case [`adae66f`](https://github.com/ljharb/shell-quote/commit/adae66f47cf11bb7a686c98059436f496d881955)
- one test was wrong, checking for pre escapes [`42b5f83`](https://github.com/ljharb/shell-quote/commit/42b5f8355196d5f2a2c40178576a5d37167e8cb2)
- finally passing all the tests [`efa4084`](https://github.com/ljharb/shell-quote/commit/efa408481db33993fce2a1dd3c15ffac0203fe4c)
- one more test passing with quote recursion [`e9537b9`](https://github.com/ljharb/shell-quote/commit/e9537b943d89535b38c0777c210b5aa9780349b2)
- use tape everywhere [`ed0c1c6`](https://github.com/ljharb/shell-quote/commit/ed0c1c6ae383998874002ae9aa452505c266d630)
- some extra metacharacter tests just to be sure [`a6782ae`](https://github.com/ljharb/shell-quote/commit/a6782aeb931221a459f9cebc371c2311ad680992)
- minor fix to an env test [`601b340`](https://github.com/ljharb/shell-quote/commit/601b3406e7012da97771b0ed538288ddb12d9af8)
- document parse env [`cc0efba`](https://github.com/ljharb/shell-quote/commit/cc0efba0bce75aaab1ead72e81470154a71ec525)
- better parse recursion to capture the containing quotes [`8467961`](https://github.com/ljharb/shell-quote/commit/84679611fd5843777d3d94f157a7b6efe11097ca)
- now just 2 tests failing with a subtle regex reordering [`5448a02`](https://github.com/ljharb/shell-quote/commit/5448a02d356722ec8ef57db2e075e10566e2dcdb)
- pass another test by using "" as the undefined [`46e6cf4`](https://github.com/ljharb/shell-quote/commit/46e6cf4b974e1cec0601e81a0dc2820dc849f775)
- fixed a failing env test [`17d1fda`](https://github.com/ljharb/shell-quote/commit/17d1fdac759e7a94ffc6edc26af27769d30e53bb)
- actually the test was wrong, module works fine [`9d7b727`](https://github.com/ljharb/shell-quote/commit/9d7b727f2911692cffe03e7792b5defad3dd75d2)
- another test to be even more sure [`5afd47b`](https://github.com/ljharb/shell-quote/commit/5afd47ba563d4c1bb7966695e100f63da4b65915)
- failing test for: echo "foo = \"foo\"" [`8dbb280`](https://github.com/ljharb/shell-quote/commit/8dbb2803136a2f7643e7e66b2d6b95f9adfbfd41)
## [0.0.1](https://github.com/ljharb/shell-quote/compare/0.0.0...0.0.1) - 2012-05-18
### Commits
- fixed unescaped metachars and bump [`5ce339f`](https://github.com/ljharb/shell-quote/commit/5ce339feeaf971a5172fe58faa3ac5f90bdfe8b5)
- failing test for unescaped metachars [`a315125`](https://github.com/ljharb/shell-quote/commit/a315125a0742b01799c89469efd20821540694f6)
- fix for escaped spaces [`669b616`](https://github.com/ljharb/shell-quote/commit/669b61610aad3e6f47e8c043e1635dcc4b5ce375)
- failing test for escaped space [`c6ff3dc`](https://github.com/ljharb/shell-quote/commit/c6ff3dc6811816a667e55a69ec09bffa52f5ee0a)
## 0.0.0 - 2012-05-18
### Commits
- readme with examples [`6373c0f`](https://github.com/ljharb/shell-quote/commit/6373c0f56de87702a61063ffae354e2bb989de91)
- package.json [`bc27efa`](https://github.com/ljharb/shell-quote/commit/bc27efa033709ede8483bb6ec0f182dcb2b87061)
- passing the parse test [`69c0f85`](https://github.com/ljharb/shell-quote/commit/69c0f8529825d3fdc700e81d32b75378cef47994)
- crazy initial thing [`d6469c9`](https://github.com/ljharb/shell-quote/commit/d6469c95adf0172adc65c4adab04910486368ee7)
- passing quote tests [`e1d6695`](https://github.com/ljharb/shell-quote/commit/e1d669503f0f159068deb45f14ba3a4bf77e90f0)
- failing parse test [`980aa58`](https://github.com/ljharb/shell-quote/commit/980aa585937d049b152b5e7b08c1e068faaaf378)
- using travis [`1c72261`](https://github.com/ljharb/shell-quote/commit/1c72261f45002744fac3fecec3f0395924d66717)
- expand more escape sequences in parse() [`8b2224c`](https://github.com/ljharb/shell-quote/commit/8b2224c465ef70d2320985c57dc0b8ee1c0a3664)
ljharb-shell-quote-2ec0702/LICENSE 0000664 0000000 0000000 00000002125 15257741626 0016564 0 ustar 00root root 0000000 0000000 The MIT License
Copyright (c) 2013 James Halliday (mail@substack.net)
Permission is hereby granted, free of charge,
to any person obtaining a copy of this software and
associated documentation files (the "Software"), to
deal in the Software without restriction, including
without limitation the rights to use, copy, modify,
merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom
the Software is furnished to do so,
subject to the following conditions:
The above copyright notice and this permission notice
shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR
ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ljharb-shell-quote-2ec0702/README.md 0000664 0000000 0000000 00000015367 15257741626 0017052 0 ustar 00root root 0000000 0000000 # shell-quote [![Version Badge][npm-version-svg]][package-url]
[![github actions][actions-image]][actions-url]
[![coverage][codecov-image]][codecov-url]
[![License][license-image]][license-url]
[![Downloads][downloads-image]][downloads-url]
[![npm badge][npm-badge-png]][package-url]
Parse and quote shell commands.
# example
## quote
```js
var quote = require('shell-quote/quote');
var s = quote([ 'a', 'b c d', '$f', '"g"' ]);
console.log(s);
```
output
```
a 'b c d' \$f '"g"'
```
## parse
```js
var parse = require('shell-quote/parse');
var xs = parse('a "b c" \\$def \'it\'\\\'\'s great\'');
console.dir(xs);
```
output
```
[ 'a', 'b c', '$def', "it's great" ]
```
## parse with ANSI-C quoting
```js
var parse = require('shell-quote/parse');
var xs = parse("echo $'it\\'s a \\n test'");
console.dir(xs);
```
output
```
[ 'echo', "it's a \n test" ]
```
## parse with an environment variable
```js
var parse = require('shell-quote/parse');
var xs = parse('beep --boop="$PWD"', { PWD: '/home/robot' });
console.dir(xs);
```
output
```
[ 'beep', '--boop=/home/robot' ]
```
## parse with custom escape character
```js
var parse = require('shell-quote/parse');
var xs = parse('beep ^--boop="$PWD"', { PWD: '/home/robot' }, { escape: '^' });
console.dir(xs);
```
output
```
[ 'beep', '--boop=/home/robot' ]
```
## parse with unquoted variable splitting
```js
var parse = require('shell-quote/parse');
var xs = parse('a $T', { T: 'c d' }, { splitUnquoted: true });
console.dir(xs);
```
output
```
[ 'a', 'c', 'd' ]
```
## parsing shell operators
```js
var parse = require('shell-quote/parse');
var xs = parse('beep || boop > /byte');
console.dir(xs);
```
output:
```
[ 'beep', { op: '||' }, 'boop', { op: '>' }, '/byte' ]
```
## parsing shell comment
```js
var parse = require('shell-quote/parse');
var xs = parse('beep > boop # > kaboom');
console.dir(xs);
```
output:
```
[ 'beep', { op: '>' }, 'boop', { comment: ' > kaboom' } ]
```
# methods
```js
var quote = require('shell-quote/quote');
var parse = require('shell-quote/parse');
```
## quote(args)
Return a quoted string for the array `args` suitable for using in shell
commands.
Each entry of `args` may be a string, or one of the object shapes that
`parse` emits: `{ op }` (where `op` is one of the control operators
`||`, `&&`, `;;&`, `;;`, `;&`, `|&`, `<(`, `>(`, `<<<`, `<<-`,
`<<`, `>>`, `>&`, `>|`, `&>>`, `&>`, `<&`, `<>`, `&`, `;`, `(`,
`)`, `|`, `<`, `>`),
`{ op: 'glob', pattern }`, or `{ comment }`. Any
other object shape, an unrecognized `op`, a `pattern`/`comment`
containing line terminators, or a string containing line terminators
anywhere after a `{ comment }` throws a `TypeError`.
The output is POSIX shell (`sh`/`bash`) quoting.
It is not valid for Windows `cmd.exe` or PowerShell,
whose rules differ and, for `cmd.exe`,
are not solvable in the general case. On Windows,
do not build a shell command string from this output;
instead pass an argument array to a non-shell API such as
`child_process.execFile` or `spawn`
(or the `cross-spawn` package),
which does no shell parsing and needs no quoting.
Use the returned string verbatim as shell input.
It is already a complete, escaped shell word (or words);
do not wrap it in additional quotes or embed it in `eval '...'`.
Re-quoting the output (for example, placing it inside single quotes)
turns its backslash escapes into literal characters and corrupts the value.
## parse(cmd, env={})
Return an array of arguments from the quoted string `cmd`.
Interpolate embedded bash-style `$VARNAME` and `${VARNAME}` variables with
the `env` object which like bash will replace undefined variables with `""`.
By default an expanded variable is a single token even when unquoted.
Pass `{ splitUnquoted: true }` to split an unquoted expansion into multiple tokens the way a shell performs field splitting,
using the default `IFS` (space, tab, newline).
Pass a string to use its characters as the `IFS` instead
(for example `{ splitUnquoted: ':' }`).
A quoted expansion (`"$VAR"`) is never split.
Bash [ANSI-C quoting](https://www.gnu.org/software/bash/manual/html_node/ANSI_002dC-Quoting.html)
(`$'...'`) is supported: escape sequences (such as `\n`, `\t`, `\\`, `\'`, `\"`,
`\xHH`, `\uHHHH`, `\UHHHHHHHH`, `\nnn`, and `\cx`) are decoded, an unrecognized
escape keeps its backslash, and the contents are never word-split and never
variable-expanded, so `${VAR}` inside `$'...'` stays literal. As in bash,
`$'...'` is not special inside double or single quotes, and a NUL ends the string.
Since the result is a JavaScript string, `\xHH` and `\nnn` produce the character
with that code (U+0000 to U+00FF), not a raw byte.
Only simple `$VARNAME` and `${VARNAME}` interpolation is supported.
Bash parameter expansion beyond a plain variable name is not evaluated:
forms such as array subscripts (`${arr[i]}`), length (`${#arr[@]}`),
and modifiers (`${var:-default}`, `${var/a/b}`)
are treated as an unknown variable and expand to `""`,
while arithmetic (`$((...))`) and command substitution (`$(...)`)
are not interpreted.
Whitespace inside `${...}` throws a `Bad substitution` error.
`env` is usually an object but it can also be a function to perform lookups.
When `env(key)` returns a string, its result will be output just like `env[key]` would.
When `env(key)` returns an object, it will be inserted into the result
array like the operator objects.
When a bash operator is encountered,
the element in the array with be an object with an `"op"` key set to the operator string.
For example:
```
'beep || boop > /byte'
```
parses as:
```
[ 'beep', { op: '||' }, 'boop', { op: '>' }, '/byte' ]
```
The here-document operators (`<<` and `<<-`) are emitted like any other operator,
followed by the delimiter word.
The here-document body is not recognized:
a newline is whitespace to `parse`,
so the lines after the command are parsed as ordinary tokens,
subject to quoting, comments, globs, and variable expansion.
# install
With [npm](http://npmjs.org) do:
```
npm install shell-quote
```
# license
MIT
[package-url]: https://npmjs.org/package/shell-quote
[npm-version-svg]: https://versionbadg.es/ljharb/shell-quote.svg
[deps-svg]: https://david-dm.org/ljharb/shell-quote.svg
[deps-url]: https://david-dm.org/ljharb/shell-quote
[npm-badge-png]: https://nodei.co/npm/shell-quote.png?downloads=true&stars=true
[license-image]: https://img.shields.io/npm/l/shell-quote.svg
[license-url]: LICENSE
[downloads-image]: https://img.shields.io/npm/dm/shell-quote.svg
[downloads-url]: https://npm-stat.com/charts.html?package=shell-quote
[codecov-image]: https://codecov.io/gh/ljharb/shell-quote/branch/main/graphs/badge.svg
[codecov-url]: https://app.codecov.io/gh/ljharb/shell-quote/
[actions-image]: https://img.shields.io/github/check-runs/ljharb/shell-quote/main
[actions-url]: https://github.com/ljharb/shell-quote/actions
ljharb-shell-quote-2ec0702/eslint.config.mjs 0000664 0000000 0000000 00000001140 15257741626 0021030 0 ustar 00root root 0000000 0000000 import ljharb from '@ljharb/eslint-config/flat';
export default [
...ljharb,
{
rules: {
'array-bracket-newline': 'off',
complexity: 'off',
eqeqeq: 'warn',
'func-style': ['error', 'declaration'],
'max-depth': 'off',
'max-lines-per-function': 'off',
'max-statements': 'off',
'multiline-comment-style': 'off',
'no-extra-parens': 'off',
'no-lonely-if': 'warn',
'no-negated-condition': 'warn',
'no-param-reassign': 'warn',
'no-shadow': 'warn',
'no-template-curly-in-string': 'off',
},
},
{
files: ['example/**'],
rules: {
'no-console': 'off',
},
},
];
ljharb-shell-quote-2ec0702/example/ 0000775 0000000 0000000 00000000000 15257741626 0017212 5 ustar 00root root 0000000 0000000 ljharb-shell-quote-2ec0702/example/env.js 0000664 0000000 0000000 00000000200 15257741626 0020330 0 ustar 00root root 0000000 0000000 'use strict';
var parse = require('../').parse;
var xs = parse('beep --boop="$PWD"', { PWD: '/home/robot' });
console.dir(xs);
ljharb-shell-quote-2ec0702/example/op.js 0000664 0000000 0000000 00000000152 15257741626 0020164 0 ustar 00root root 0000000 0000000 'use strict';
var parse = require('../').parse;
var xs = parse('beep || boop > /byte');
console.dir(xs);
ljharb-shell-quote-2ec0702/example/parse.js 0000664 0000000 0000000 00000000166 15257741626 0020665 0 ustar 00root root 0000000 0000000 'use strict';
var parse = require('../').parse;
var xs = parse('a "b c" \\$def \'it\\\'s great\'');
console.dir(xs);
ljharb-shell-quote-2ec0702/example/quote.js 0000664 0000000 0000000 00000000155 15257741626 0020706 0 ustar 00root root 0000000 0000000 'use strict';
var quote = require('../').quote;
var s = quote(['a', 'b c d', '$f', '"g"']);
console.log(s);
ljharb-shell-quote-2ec0702/index.d.ts 0000664 0000000 0000000 00000001551 15257741626 0017462 0 ustar 00root root 0000000 0000000 import quote = require('./quote');
import parse = require('./parse');
export { quote, parse };
export type ControlOperator = parse.ControlOperator;
export type GlobPattern = parse.GlobPattern;
export type Comment = parse.Comment;
export type ParseEntry = parse.ParseEntry;
export type ParseOptions = parse.ParseOptions;
type Join = T extends readonly []
? ''
: T extends readonly [infer F extends string]
? F
: T extends readonly [infer F extends string, ...infer R extends string[]]
? `${F}${D}${Join}`
: string;
declare global {
interface ReadonlyArray {
join(this: This, separator?: D): Join;
}
interface Array {
join(this: This, separator?: D): Join;
}
}
ljharb-shell-quote-2ec0702/index.js 0000664 0000000 0000000 00000000127 15257741626 0017224 0 ustar 00root root 0000000 0000000 'use strict';
exports.quote = require('./quote');
exports.parse = require('./parse');
ljharb-shell-quote-2ec0702/package.json 0000664 0000000 0000000 00000004016 15257741626 0020046 0 ustar 00root root 0000000 0000000 {
"name": "shell-quote",
"description": "quote and parse shell commands",
"version": "1.12.0",
"author": {
"name": "James Halliday",
"email": "mail@substack.net",
"url": "http://substack.net"
},
"funding": {
"url": "https://github.com/sponsors/ljharb"
},
"bugs": "https://github.com/ljharb/shell-quote/issues",
"homepage": "https://github.com/ljharb/shell-quote",
"keywords": [
"command",
"parse",
"quote",
"shell"
],
"license": "MIT",
"main": "index.js",
"types": "index.d.ts",
"repository": {
"type": "git",
"url": "http://github.com/ljharb/shell-quote.git"
},
"scripts": {
"prepack": "npmignore --auto --commentLines=autogenerated",
"prepublish": "not-in-publish || npm run prepublishOnly",
"prepublishOnly": "safe-publish-latest",
"prelint": "evalmd README.md",
"lint": "eslint --ext=js,mjs .",
"postlint": "tsc -p . && attw -P",
"pretest": "npm run lint",
"tests-only": "nyc tape 'test/**/*.js'",
"test": "npm run tests-only",
"posttest": "npx npm@'>=10.2' audit --production",
"version": "auto-changelog && git add CHANGELOG.md",
"postversion": "auto-changelog && git add CHANGELOG.md && git commit --no-edit --amend && git tag -f \"v$(node -e \"console.log(require('./package.json').version)\")\""
},
"devDependencies": {
"@arethetypeswrong/cli": "^0.18.5",
"@ljharb/eslint-config": "^22.2.5",
"@ljharb/tsconfig": "^0.3.2",
"auto-changelog": "^2.7.0",
"eslint": "^10.11.0",
"evalmd": "^0.0.22",
"in-publish": "^2.0.1",
"jiti": "^0.0.0",
"npmignore": "^0.3.5",
"nyc": "^10.3.2",
"safe-publish-latest": "^2.0.0",
"tape": "^5.10.2",
"typescript": "next"
},
"auto-changelog": {
"output": "CHANGELOG.md",
"template": "keepachangelog",
"unreleased": false,
"commitLimit": false,
"backfillLimit": false,
"hideCredit": true,
"startingVersion": "1.7.4"
},
"publishConfig": {
"ignore": [
".github/workflows",
".nycrc",
"eslint.config.mjs",
"example",
"CHANGELOG.md",
"security.md",
"test"
]
},
"engines": {
"node": ">= 0.4"
}
}
ljharb-shell-quote-2ec0702/parse.d.ts 0000664 0000000 0000000 00000003471 15257741626 0017470 0 ustar 00root root 0000000 0000000 declare namespace parse {
/** A shell control operator. */
export interface ControlOperator {
op: '||' | '&&' | ';;&' | ';;' | ';&' | '|&' | '<(' | '>(' | '<<<' | '<<-' | '<<' | '>>' | '>&' | '>|' | '&>>' | '&>' | '<&' | '<>' | '&' | ';' | '(' | ')' | '|' | '<' | '>';
}
/** A glob pattern parsed from the shell command. */
export interface GlobPattern {
op: 'glob';
pattern: string;
}
/** A shell comment. */
export interface Comment {
comment: string;
}
/** A parsed token returned by {@link parse}. */
export type ParseEntry = string | ControlOperator | GlobPattern | Comment;
/** Options for the {@link parse} function. */
export interface ParseOptions {
/** Custom escape character. Defaults to `\\`. */
escape?: string;
/** Field-splits an unquoted variable expansion, the way a shell does using `IFS`; quoted expansions are never split. `true` uses the default IFS (space, tab, newline); a string uses its characters as the IFS. An empty string, `false`, or omitting the option disables splitting. Defaults to false. */
splitUnquoted?: boolean | string;
}
export type Env =
| Record
| ((key: string) => string | object | undefined);
}
/**
* Parses a shell command string into an array of tokens.
*
* @param s - The shell command string to parse.
* @param env - Optional environment variables for expansion, either as an object of string values or a lookup function. When the lookup function returns an object, that object is inserted into the result verbatim.
* @param opts - Optional parsing options.
* @returns An array of parsed tokens, including any objects returned by an `env` lookup function.
*/
declare function parse(
s: string,
env?: parse.Env,
opts?: parse.ParseOptions,
): (parse.ParseEntry | T)[];
export = parse;
ljharb-shell-quote-2ec0702/parse.js 0000664 0000000 0000000 00000023562 15257741626 0017237 0 ustar 00root root 0000000 0000000 'use strict';
/**
* @import {
* ControlOperator,
* Env,
* GlobPattern,
* ParseEntry,
* } from './parse' */
// '<(' and '>(' are process substitution operators and
// can be parsed the same as control operator
var CONTROL = /** @type {const} */ ('(?:') + /** @type {const} */ ([
'\\|\\|',
'\\&(?:\\&|>>?)', // `&&`, `&>`, and `&>>`
';;\\&?', // `;;` and `;;&`
'[;|]\\&', // `;&` and `|&`
'\\<\\(',
'\\<\\<\\<',
'\\<\\<-',
'\\<\\<(?!\\()', // `<<(` stays `<` and `<(`, as zsh reads it; other shells reject it
'>>',
'>[&|(]', // `>&`, `>|`, and `>(`
'<[&>]', // `<&` and `<>`
'[&;()|<>]'
]).join(/** @type {const} */ ('|')) + /** @type {const} */ (')');
var controlRE = new RegExp('^' + CONTROL + '$');
var META = /** @type {const} */ ('|&;()<> \\t');
var SINGLE_QUOTE = /** @type {const} */ ('\'([^\']*?)\'');
// bash ANSI-C quoting, `$'...'`: a backslash escapes the next character, including `'`
var ANSI_C_BODY = '(?:\\\\[\\s\\S]|[^\\\\\'])*?';
var ANSI_C_QUOTE = '\\$\'' + ANSI_C_BODY + '\'';
var ansiCAt = new RegExp('\\$\'' + ANSI_C_BODY + '(?:(\')|\\\\?$)', 'g');
var ANSI_C_LETTERS = 'abeEfnrtv';
var ANSI_C_CHARS = '\x07\b\x1B\x1B\f\n\r\t\v';
var hash = /^#$/;
var SQ = /** @type {const} */ ("'");
var DQ = /** @type {const} */ ('"');
var DS = /** @type {const} */ ('$');
var TOKEN = '';
var mult = /** @type {const} */ (0x100000000); // Math.pow(16, 8);
for (var i = 0; i < 4; i++) {
TOKEN += (mult * Math.random()).toString(16);
}
var startsWithToken = new RegExp('^' + TOKEN);
/**
* @param {string} s
* @param {RegExp} r
*/
function matchAll(s, r) {
var origIndex = r.lastIndex;
var matches = [];
var matchObj;
while ((matchObj = r.exec(s))) {
matches[matches.length] = matchObj;
if (r.lastIndex === matchObj.index) {
r.lastIndex += 1;
}
}
r.lastIndex = origIndex;
return matches;
}
/**
* @param {Env} env
* @param {string} pre
* @param {string} key
*/
function getVar(env, pre, key) {
var r = typeof env === 'function' ? env(key) : env[key];
if (typeof r === 'undefined' && key != '') {
r = '';
} else if (typeof r === 'undefined') {
r = '$';
}
if (typeof r === 'object') {
return pre + TOKEN + JSON.stringify(r) + TOKEN;
}
return pre + r;
}
var ansiCEscape = /\\([0-7]{1,3}|x[\dA-Fa-f]{1,2}|u[\dA-Fa-f]{1,4}|U[\dA-Fa-f]{1,8}|c(?:\\\\|[\s\S])|[abeEfnrtv\\'"?])/g;
/**
* @param {string} m
* @param {string} escape
*/
function expandAnsiCEscape(m, escape) {
var kind = escape.charAt(0);
if (kind === 'c') {
var ctrl = escape.charAt(1);
return ctrl === '?' ? '\x7F' : String.fromCharCode(ctrl.charCodeAt(0) & 0x1F);
}
if (kind === 'x' || kind === 'u' || kind === 'U') {
var cp = parseInt(escape.slice(1), 16);
if (cp > 0x10FFFF) {
return m;
}
return String.fromCharCode.apply(null, cp > 0xFFFF ? [0xD7C0 + (cp >> 10), 0xDC00 + (cp & 0x3FF)] : [cp]);
}
if (kind >= '0' && kind <= '7') {
return String.fromCharCode(parseInt(escape, 8) & 0xFF);
}
var letter = ANSI_C_LETTERS.indexOf(escape);
return letter < 0 ? escape : ANSI_C_CHARS.charAt(letter);
}
/** @param {string} body */
function expandAnsiC(body) {
return body.replace(ansiCEscape, expandAnsiCEscape).split('\0')[0]; // like bash, a NUL ends the string
}
/**
* @param {string} s
* @param {number} i
*/
function closesAnsiC(s, i) {
ansiCAt.lastIndex = i;
return !!(/** @type {RegExpExecArray} */ (ansiCAt.exec(s)))[1];
}
/**
* @param {string} string
* @param {Env} [env]
* @param {{ escape?: string, splitUnquoted?: boolean | string }} [opts]
* @returns {ParseEntry[]}
*/
function parseInternal(string, env, opts) {
if (!opts) {
opts = {};
}
var BS = opts.escape || '\\';
var ifs = opts.splitUnquoted === true ? ' \t\n' : (typeof opts.splitUnquoted === 'string' ? opts.splitUnquoted : '');
var BAREWORD = '(\\' + BS + '[\'"$\\' + BS + META + ']|\\$\\$|\\$(?!' + ANSI_C_QUOTE.slice(2) + ')|[^\\s\'"$' + META + '])+';
var DOUBLE_QUOTE = '"(?:\\' + BS + '[\\s\\S]|[^"\\' + BS + '])*"';
var chunker = new RegExp([
'(' + CONTROL + ')', // control chars
'(' + ANSI_C_QUOTE + '|' + BAREWORD + '|' + DOUBLE_QUOTE + '|' + SINGLE_QUOTE + ')+'
].join('|'), 'g');
var matches = matchAll(string, chunker);
if (matches.length === 0) {
return [];
}
if (!env) {
env = {};
}
var commented = false;
return matches.map(function (match) {
var s = match[0];
if (!s || commented) {
return void undefined;
}
if (controlRE.test(s)) {
return /** @type {ControlOperator} */ ({ op: s });
}
// Hand-written scanner/parser for Bash quoting rules:
//
// 1. inside single quotes, all characters are printed literally.
// 2. inside double quotes, all characters are printed literally
// except variables prefixed by '$' and backslashes followed by
// either a double quote or another backslash.
// 3. outside of any quotes, backslashes are treated as escape
// characters and not printed (unless they are themselves escaped)
// 4. quote context can switch mid-token if there is no whitespace
// between the two quote contexts (e.g. all'one'"token" parses as
// "allonetoken")
/** @type {string | boolean} */
var quote = false;
var esc = false;
var out = '';
/** @type {string[]} */
var words = [];
var sawQuote = false;
/** @type {number | null} */
var pendingNw = null;
var isGlob = false;
/** @type {number} */
var i;
function parseEnvVar() {
i += 1;
/** @type {number | RegExpMatchArray | null} */
var varend;
/** @type {string} */
var varname;
var char = s.charAt(i);
if (char === '{') {
i += 1;
if (s.charAt(i) === '}') {
throw new Error('Bad substitution: ' + s.slice(i - 2, i + 1));
}
// match braces by depth so a nested `${` keeps its inner `}` from ending the outer substitution
var depth = 1;
varend = i;
while (depth > 0 && varend < s.length) {
if (s.charAt(varend) === '{' && s.charAt(varend - 1) === '$') {
depth += 1;
} else if (s.charAt(varend) === '}') {
depth -= 1;
}
varend += 1;
}
if (depth !== 0) {
throw new Error('Bad substitution: ' + s.slice(i));
}
varend -= 1;
varname = s.slice(i, varend);
i = varend;
} else if ((/[*@#?$!-]/).test(char)) {
varname = char;
} else {
var slicedFromI = s.slice(i);
varend = slicedFromI.match(/[^\w\d_]/);
if (!varend) {
varname = slicedFromI;
i = s.length;
} else {
varname = slicedFromI.slice(0, varend.index);
i += /** @type {number} */ (varend.index) - 1;
}
}
return getVar(/** @type {NonNullable} */ (env), '', varname);
}
function flushRun() {
if (pendingNw === null) {
return;
}
if (pendingNw === 0) {
if (out !== '') {
words[words.length] = out;
out = '';
}
} else {
words[words.length] = out;
out = '';
for (var fe = 1; fe < pendingNw; fe += 1) {
words[words.length] = '';
}
}
pendingNw = null;
}
for (i = 0; i < s.length; i++) {
var c = s.charAt(i);
if (ifs && c !== DS) {
flushRun();
}
isGlob = isGlob || (!quote && (c === '*' || c === '?'));
if (esc) {
out += c;
esc = false;
} else if (quote) {
if (c === quote) {
quote = false;
} else if (quote == SQ) {
out += c;
} else { // Double quote
if (c === BS) {
i += 1;
c = s.charAt(i);
if (c === DQ || c === BS || c === DS) {
out += c;
} else {
out += BS + c;
}
} else if (c === DS) {
out += parseEnvVar();
} else {
out += c;
}
}
} else if (c === DQ || c === SQ) {
quote = c;
sawQuote = true;
} else if (controlRE.test(c)) {
return /** @type {ControlOperator} */ ({ op: s });
} else if (hash.test(c)) {
commented = true;
var commentObj = { comment: string.slice(match.index + i + 1) };
if (out.length) {
return /** @type {const} */ ([out, commentObj]);
}
return /** @type {const} */ ([commentObj]);
} else if (c === BS) {
esc = true;
} else if (c === DS && s.charAt(i + 1) === SQ && closesAnsiC(s, i)) {
flushRun();
sawQuote = true;
out += expandAnsiC(s.slice(i + 2, ansiCAt.lastIndex - 1));
i = ansiCAt.lastIndex - 1;
} else if (c === DS) {
var value = parseEnvVar();
if (!ifs) {
out += value;
} else {
for (var vi = 0; vi < value.length; vi += 1) {
var vc = value.charAt(vi);
if (ifs.indexOf(vc) < 0) {
flushRun();
out += vc;
} else if (pendingNw === null) {
pendingNw = vc === ' ' || vc === '\t' || vc === '\n' ? 0 : 1;
} else if (vc !== ' ' && vc !== '\t' && vc !== '\n') {
pendingNw += 1;
}
}
}
} else {
out += c;
}
}
if (isGlob) {
return /** @type {GlobPattern} */ ({ op: 'glob', pattern: out });
}
if (ifs) {
if (pendingNw !== null && pendingNw > 0) {
words[words.length] = out;
out = '';
for (var te = 1; te < pendingNw; te += 1) {
words[words.length] = '';
}
}
if (out !== '' || (sawQuote && words.length === 0)) {
words[words.length] = out;
}
return words;
}
return out;
}).reduce(function (prev, arg) { // finalize parsed arguments
if (typeof arg === 'undefined') {
return prev;
}
/** @type {ParseEntry[]} */ ([]).concat(arg).forEach(function (entry) {
prev[prev.length] = entry;
});
return prev;
}, /** @type {ParseEntry[]} */ ([]));
}
/** @type {typeof import('./parse')} */
module.exports = function parse(s, env, opts) {
var mapped = parseInternal(s, env, opts);
if (typeof env !== 'function') {
return mapped;
}
return mapped.reduce(function (acc, s) {
if (typeof s === 'object') {
acc[acc.length] = s;
return acc;
}
var xs = s.split(RegExp('(' + TOKEN + '.*?' + TOKEN + ')', 'g'));
if (xs.length === 1) {
acc[acc.length] = xs[0];
return acc;
}
xs.filter(Boolean).forEach(function (x) {
acc[acc.length] = startsWithToken.test(x)
? JSON.parse(x.split(TOKEN)[1])
: x;
});
return acc;
}, /** @type {ParseEntry[]} */ ([]));
};
ljharb-shell-quote-2ec0702/quote.d.ts 0000664 0000000 0000000 00000001057 15257741626 0017511 0 ustar 00root root 0000000 0000000 import parse = require('./parse');
/**
* Quotes an array of tokens into a shell-safe string.
*
* Accepts strings and the object shapes that {@link parse} emits. Throws a
* `TypeError` for unrecognized object shapes, `op` values outside the
* allowlist, `pattern`/`comment` values containing line terminators, or
* strings containing line terminators anywhere after a `comment`.
*
* @param args - Array of tokens to quote.
* @returns A shell-safe quoted string.
*/
declare function quote(args: readonly parse.ParseEntry[]): string;
export = quote;
ljharb-shell-quote-2ec0702/quote.js 0000664 0000000 0000000 00000004067 15257741626 0017261 0 ustar 00root root 0000000 0000000 'use strict';
/** @import { ControlOperator } from './parse' */
/** @type {ControlOperator['op'][]} */
var OPS = /** @type {const} */ ([
'||',
'&&',
';;&',
';;',
';&',
'|&',
'<(',
'>(',
'<<<',
'<<-',
'<<',
'>>',
'>&',
'>|',
'&>>',
'&>',
'<&',
'<>',
'&',
';',
'(',
')',
'|',
'<',
'>'
]);
var LINE_TERMINATORS = /[\n\r\u2028\u2029]/;
var GLOB_SHELL_SPECIAL = /[\s#!"$&'():;<=>@\\^`|~]/g;
/** @type {typeof import('./quote')} */
module.exports = function quote(xs) {
var sawComment = false;
return xs.map(function (s) {
if (sawComment && typeof s === 'string' && LINE_TERMINATORS.test(s)) {
throw new TypeError('a token after a `comment` must not contain line terminators');
}
if (s === '') {
return /** @type {const} */ ('\'\'');
}
if (s && typeof s === 'object') {
if ('op' in s && s.op === 'glob') {
if (typeof s.pattern !== 'string') {
throw new TypeError('glob token requires a string `pattern`');
}
if (LINE_TERMINATORS.test(s.pattern)) {
throw new TypeError('glob `pattern` must not contain line terminators');
}
if (s.pattern === '') {
return /** @type {const} */ ('\'\'');
}
return s.pattern.replace(GLOB_SHELL_SPECIAL, '\\$&');
}
if ('op' in s && typeof s.op === 'string') {
if (OPS.indexOf(s.op) < 0) {
throw new TypeError('invalid `op` value: ' + JSON.stringify(s.op));
}
return s.op.replace(/[\s\S]/g, '\\$&');
}
if ('comment' in s && typeof s.comment === 'string') {
if (LINE_TERMINATORS.test(s.comment)) {
throw new TypeError('`comment` must not contain line terminators');
}
sawComment = true;
return '#' + s.comment;
}
throw new TypeError('unrecognized object token shape');
}
if ((/'/).test(s) && (/!/).test(s)) {
return "'" + s.replace(/'/g, "'\"'\"'") + "'";
}
if ((/["\s\\]/).test(s) && !(/'/).test(s)) {
return "'" + s + "'";
}
if ((/["'\s]/).test(s)) {
return '"' + s.replace(/(["\\$`])/g, '\\$1') + '"';
}
return String(s).replace(/([A-Za-z]:)?([#!"$&'()*,:;<=>?@[\\\]^`{|}~])/g, '$1\\$2');
}).join(' ');
};
ljharb-shell-quote-2ec0702/security.md 0000664 0000000 0000000 00000000447 15257741626 0017755 0 ustar 00root root 0000000 0000000 # Security Policy
## Supported Versions
Only the latest major version is supported at any given time.
## Reporting a Vulnerability
To report a security vulnerability, please use the
[Tidelift security contact](https://tidelift.com/security).
Tidelift will coordinate the fix and disclosure.
ljharb-shell-quote-2ec0702/test/ 0000775 0000000 0000000 00000000000 15257741626 0016536 5 ustar 00root root 0000000 0000000 ljharb-shell-quote-2ec0702/test/comment.js 0000664 0000000 0000000 00000001202 15257741626 0020531 0 ustar 00root root 0000000 0000000 'use strict';
var test = require('tape');
var parse = require('../').parse;
test('comment', function (t) {
t.same(parse('beep#boop'), ['beep', { comment: 'boop' }]);
t.same(parse('beep #boop'), ['beep', { comment: 'boop' }]);
t.same(parse('beep # boop'), ['beep', { comment: ' boop' }]);
t.same(parse('beep # > boop'), ['beep', { comment: ' > boop' }]);
t.same(parse('beep # "> boop"'), ['beep', { comment: ' "> boop"' }]);
t.same(parse('beep "#"'), ['beep', '#']);
t.same(parse('beep #"#"#'), ['beep', { comment: '"#"#' }]);
t.same(parse('beep > boop # > foo'), ['beep', { op: '>' }, 'boop', { comment: ' > foo' }]);
t.end();
});
ljharb-shell-quote-2ec0702/test/env.js 0000664 0000000 0000000 00000010626 15257741626 0017671 0 ustar 00root root 0000000 0000000 'use strict';
var test = require('tape');
var parse = require('../').parse;
test('expand environment variables', function (t) {
t.same(parse('a $XYZ c', { XYZ: 'b' }), ['a', 'b', 'c']);
t.same(parse('a${XYZ}c', { XYZ: 'b' }), ['abc']);
t.same(parse('a${XYZ}c $XYZ', { XYZ: 'b' }), ['abc', 'b']);
t.same(parse('"-$X-$Y-"', { X: 'a', Y: 'b' }), ['-a-b-']);
t.same(parse("'-$X-$Y-'", { X: 'a', Y: 'b' }), ['-$X-$Y-']);
t.same(parse('qrs"$zzz"wxy', { zzz: 'tuv' }), ['qrstuvwxy']);
t.same(parse("qrs'$zzz'wxy", { zzz: 'tuv' }), ['qrs$zzzwxy']);
t.same(parse('qrs${zzz}wxy'), ['qrswxy']);
t.same(parse('qrs$wxy $'), ['qrs', '$']);
t.same(parse('grep "xy$"'), ['grep', 'xy$']);
t.same(parse('ab$x', { x: 'c' }), ['abc']);
t.same(parse('ab\\$x', { x: 'c' }), ['ab$x']);
t.same(parse('ab${x}def', { x: 'c' }), ['abcdef']);
t.same(parse('ab\\${x}def', { x: 'c' }), ['ab${x}def']);
t.same(parse('"ab\\${x}def"', { x: 'c' }), ['ab${x}def']);
t.end();
});
test('expand environment variables within here-strings', function (t) {
t.same(parse('a <<< $x', { x: 'Joe' }), ['a', { op: '<<<' }, 'Joe']);
t.same(parse('a <<< ${x}', { x: 'Joe' }), ['a', { op: '<<<' }, 'Joe']);
t.same(parse('a <<< "$x"', { x: 'Joe' }), ['a', { op: '<<<' }, 'Joe']);
t.same(parse('a <<< "${x}"', { x: 'Joe' }), ['a', { op: '<<<' }, 'Joe']);
t.end();
});
test('environment variables with metacharacters', function (t) {
t.same(parse('a $XYZ c', { XYZ: '"b"' }), ['a', '"b"', 'c']);
t.same(parse('a $XYZ c', { XYZ: '$X', X: 5 }), ['a', '$X', 'c']);
t.same(parse('a"$XYZ"c', { XYZ: "'xyz'" }), ["a'xyz'c"]);
t.end();
});
test('special shell parameters', function (t) {
var chars = '*@#?-$!0_'.split('');
t.plan(chars.length);
chars.forEach(function (c) {
var env = {};
env[c] = 'xxx';
t.same(parse('a $' + c + ' c', env), ['a', 'xxx', 'c']);
});
});
test('special shell parameters preserve adjacent text', function (t) {
'*@#?-$!'.split('').forEach(function (c) {
var env = {};
env[c] = 'value';
t.same(parse('$' + c + 'suffix', env), ['valuesuffix'], 'unquoted $' + c + ' with a suffix');
t.same(parse('"$' + c + 'suffix"', env), ['valuesuffix'], 'double-quoted $' + c + ' with a suffix');
t.same(parse('$' + c + ':suffix', env), ['value:suffix'], '$' + c + ' followed by punctuation');
t.same(parse('$' + c, env), ['value'], '$' + c + ' at the end of input');
t.same(parse('"$' + c + '"', env), ['value'], '$' + c + ' before a closing quote');
});
t.end();
});
test('resume parsing syntax after a special shell parameter', function (t) {
var env = { '?': '1', '!': '2' };
t.same(parse('$?$!', env), ['12'], 'expand consecutive special parameters');
t.same(parse('"$?$!"', env), ['12'], 'expand consecutive special parameters inside double quotes');
t.same(parse('$?\\ suffix', env), ['1 suffix'], 'handle an escaped space after a special parameter');
t.same(parse('"$?"\'suffix\'', env), ['1suffix'], 'close double quotes before entering single quotes');
t.same(parse('$?;echo', env), ['1', { op: ';' }, 'echo'], 'preserve a control operator after a special parameter');
t.same(parse('$?suffix'), ['suffix'], 'preserve the suffix when the parameter is unset');
t.same(parse('$?suffix', { '?': 'one two' }, { splitUnquoted: true }), ['one', 'twosuffix'], 'append the suffix to the last split field');
t.same(parse('$?$!', function (key) { return env[key]; }), ['12'], 'expand consecutive special parameters with a lookup function');
t.same(parse('$?\'#x\' y', env), ['1#x', 'y'], 'open single quotes right after a special parameter');
t.same(parse('$?"a;b"', env), ['1a;b'], 'open double quotes right after a special parameter');
t.same(parse('$?\\$x', { '?': '1', x: 'X' }), ['1$x'], 'keep an escaped dollar sign after a special parameter literal');
t.same(parse('$?*', env), [{ op: 'glob', pattern: '1*' }], 'a glob character after a special parameter makes a glob');
t.end();
});
test('`$_` followed by name characters is a longer variable name', function (t) {
var env = {
_: 'A',
_foo: 'B',
__: 'C',
_1: 'D'
};
t.same(parse('$_foo', env), ['B'], '`$_foo` is the variable `_foo`');
t.same(parse('$__', env), ['C'], '`$__` is the variable `__`');
t.same(parse('$_1', env), ['D'], '`$_1` is the variable `_1`');
t.same(parse('"$_foo"', env), ['B'], 'double-quoted `$_foo` is the variable `_foo`');
t.same(parse('$_:x', env), ['A:x'], '`$_` followed by punctuation');
t.same(parse('$_', env), ['A'], '`$_` at the end of input');
t.end();
});
ljharb-shell-quote-2ec0702/test/env_fn.js 0000664 0000000 0000000 00000000743 15257741626 0020353 0 ustar 00root root 0000000 0000000 'use strict';
var test = require('tape');
var parse = require('../').parse;
function getEnv() {
return 'xxx';
}
function getEnvObj() {
return { op: '@@' };
}
test('functional env expansion', function (t) {
t.plan(4);
t.same(parse('a $XYZ c', getEnv), ['a', 'xxx', 'c']);
t.same(parse('a $XYZ c', getEnvObj), ['a', { op: '@@' }, 'c']);
t.same(parse('a${XYZ}c', getEnvObj), ['a', { op: '@@' }, 'c']);
t.same(parse('"a $XYZ c"', getEnvObj), ['a ', { op: '@@' }, ' c']);
});
ljharb-shell-quote-2ec0702/test/op.js 0000664 0000000 0000000 00000032743 15257741626 0017523 0 ustar 00root root 0000000 0000000 'use strict';
var test = require('tape');
var parse = require('../').parse;
test('single operators', function (t) {
t.same(parse('beep | boop'), ['beep', { op: '|' }, 'boop']);
t.same(parse('beep|boop'), ['beep', { op: '|' }, 'boop']);
t.same(parse('beep \\| boop'), ['beep', '|', 'boop']);
t.same(parse('beep "|boop"'), ['beep', '|boop']);
t.same(parse('echo zing &'), ['echo', 'zing', { op: '&' }]);
t.same(parse('echo zing&'), ['echo', 'zing', { op: '&' }]);
t.same(parse('echo zing\\&'), ['echo', 'zing&']);
t.same(parse('echo "zing\\&"'), ['echo', 'zing\\&']);
t.same(parse('beep;boop'), ['beep', { op: ';' }, 'boop']);
t.same(parse('(beep;boop)'), [
{ op: '(' }, 'beep', { op: ';' }, 'boop', { op: ')' }
]);
t.same(parse('beep>boop'), ['beep', { op: '>' }, 'boop']);
t.same(parse('beep 2>boop'), ['beep', '2', { op: '>' }, 'boop']);
t.same(parse('beep>blip'),
['beep', { op: ';;' }, 'boop', { op: '|&' }, 'byte', { op: '>>' }, 'blip']
);
t.same(parse('beep 2>&1'), ['beep', '2', { op: '>&' }, '1']);
t.same(
parse('beep<(boop)'),
['beep', { op: '<(' }, 'boop', { op: ')' }]
);
t.same(
parse('beep<<(boop)'),
['beep', { op: '<' }, { op: '<(' }, 'boop', { op: ')' }]
);
t.end();
});
test('duplicating input file descriptors', function (t) {
// duplicating stdout to file descriptor 3
t.same(parse('beep 3<&1'), ['beep', '3', { op: '<&' }, '1']);
// duplicating stdout to file descriptor 0, i.e. stdin
t.same(parse('beep <&1'), ['beep', { op: '<&' }, '1']);
// closes stdin
t.same(parse('beep <&-'), ['beep', { op: '<&' }, '-']);
t.end();
});
test('here strings', function (t) {
t.same(parse('cat <<< "hello world"'), ['cat', { op: '<<<' }, 'hello world']);
t.same(parse('cat <<< hello'), ['cat', { op: '<<<' }, 'hello']);
t.same(parse('cat<< tmp.txt << a'), ['cat', { op: '>' }, 'tmp.txt', { op: '<<' }, 'a']);
t.same(parse('cat << EOF'), ['cat', { op: '<<' }, 'EOF']);
t.same(parse('cat< boop'), ['beep', { op: '<>' }, 'boop']);
t.same(parse('beep<>boop'), ['beep', { op: '<>' }, 'boop']);
t.same(parse('beep 3<>boop'), ['beep', '3', { op: '<>' }, 'boop']);
t.same(parse('beep < > boop'), ['beep', { op: '<' }, { op: '>' }, 'boop'], 'separated');
t.same(parse('beep \\<\\> boop'), ['beep', '<>', 'boop'], 'escaped');
t.same(parse('beep "<>" boop'), ['beep', '<>', 'boop'], 'quoted');
t.same(parse('beep <> boop', {}, { escape: '^' }), ['beep', { op: '<>' }, 'boop'], 'with a custom escape');
t.same(parse('beep ^<^> boop', {}, { escape: '^' }), ['beep', '<>', 'boop'], 'escaped with a custom escape');
t.same(parse('beep >< boop'), ['beep', { op: '>' }, { op: '<' }, 'boop'], '`><` is not an operator');
t.same(parse('beep <>> boop'), ['beep', { op: '<>' }, { op: '>' }, 'boop']);
t.same(parse('beep <<> boop'), ['beep', { op: '<<' }, { op: '>' }, 'boop'], '`<<` wins over `<>`');
t.end();
});
test('redirecting output despite noclobber', function (t) {
t.same(parse('beep >| boop'), ['beep', { op: '>|' }, 'boop']);
t.same(parse('beep>|boop'), ['beep', { op: '>|' }, 'boop']);
t.same(parse('beep 2>|boop'), ['beep', '2', { op: '>|' }, 'boop']);
t.same(parse('beep > | boop'), ['beep', { op: '>' }, { op: '|' }, 'boop'], 'separated');
t.same(parse('beep \\>\\| boop'), ['beep', '>|', 'boop'], 'escaped');
t.same(parse('beep ">|" boop'), ['beep', '>|', 'boop'], 'quoted');
t.same(parse('beep >| boop', {}, { escape: '^' }), ['beep', { op: '>|' }, 'boop'], 'with a custom escape');
t.same(parse('beep ^>^| boop', {}, { escape: '^' }), ['beep', '>|', 'boop'], 'escaped with a custom escape');
t.same(parse('beep >|| boop'), ['beep', { op: '>|' }, { op: '|' }, 'boop'], '`>|` wins over `||`');
t.same(parse('beep >|& boop'), ['beep', { op: '>|' }, { op: '&' }, 'boop'], '`>|` wins over `|&`');
t.same(parse('beep <>| boop'), ['beep', { op: '<>' }, { op: '|' }, 'boop'], '`<>` wins over `>|`');
t.same(parse('beep |> boop'), ['beep', { op: '|' }, { op: '>' }, 'boop'], '`|>` is not an operator');
t.end();
});
test('output process substitution', function (t) {
t.same(parse('beep >(boop)'), ['beep', { op: '>(' }, 'boop', { op: ')' }]);
t.same(parse('beep>(boop)'), ['beep', { op: '>(' }, 'boop', { op: ')' }]);
t.same(parse('beep > >(boop)'), ['beep', { op: '>' }, { op: '>(' }, 'boop', { op: ')' }]);
t.same(
parse('beep >(boop) <(byte)'),
['beep', { op: '>(' }, 'boop', { op: ')' }, { op: '<(' }, 'byte', { op: ')' }]
);
t.same(parse('beep > (boop)'), ['beep', { op: '>' }, { op: '(' }, 'boop', { op: ')' }], 'separated');
t.same(parse('beep \\>\\(boop\\)'), ['beep', '>(boop)'], 'escaped');
t.same(parse('beep ">(boop)"'), ['beep', '>(boop)'], 'quoted');
t.same(parse('beep >(boop)', {}, { escape: '^' }), ['beep', { op: '>(' }, 'boop', { op: ')' }], 'with a custom escape');
t.same(parse('beep ^>^(boop^)', {}, { escape: '^' }), ['beep', '>(boop)'], 'escaped with a custom escape');
t.same(parse('beep >&(boop)'), ['beep', { op: '>&' }, { op: '(' }, 'boop', { op: ')' }], '`>&` wins over `>(`');
t.same(parse('beep <>(boop)'), ['beep', { op: '<>' }, { op: '(' }, 'boop', { op: ')' }], '`<>` wins over `>(`');
t.end();
});
test('redirecting stdout and stderr', function (t) {
t.same(parse('beep &> boop'), ['beep', { op: '&>' }, 'boop']);
t.same(parse('beep&>boop'), ['beep', { op: '&>' }, 'boop']);
t.same(parse('beep &>/dev/null'), ['beep', { op: '&>' }, '/dev/null']);
t.same(parse('beep & > boop'), ['beep', { op: '&' }, { op: '>' }, 'boop'], 'separated');
t.same(parse('beep \\&\\> boop'), ['beep', '&>', 'boop'], 'escaped');
t.same(parse('beep "&>" boop'), ['beep', '&>', 'boop'], 'quoted');
t.same(parse('beep &> boop', {}, { escape: '^' }), ['beep', { op: '&>' }, 'boop'], 'with a custom escape');
t.same(parse('beep ^&^> boop', {}, { escape: '^' }), ['beep', '&>', 'boop'], 'escaped with a custom escape');
t.same(parse('beep &>(boop)'), ['beep', { op: '&>' }, { op: '(' }, 'boop', { op: ')' }], '`&>` wins over `>(`');
t.same(parse('beep &&> boop'), ['beep', { op: '&&' }, { op: '>' }, 'boop'], '`&&` wins over `&>`');
t.same(parse('beep >&> boop'), ['beep', { op: '>&' }, { op: '>' }, 'boop'], '`>&` wins over `&>`');
t.same(parse('beep |&> boop'), ['beep', { op: '|&' }, { op: '>' }, 'boop'], '`|&` wins over `&>`');
t.end();
});
test('appending stdout and stderr', function (t) {
t.same(parse('beep &>> boop'), ['beep', { op: '&>>' }, 'boop']);
t.same(parse('beep&>>boop'), ['beep', { op: '&>>' }, 'boop']);
t.same(parse('beep & >> boop'), ['beep', { op: '&' }, { op: '>>' }, 'boop'], 'separated');
t.same(parse('beep &> > boop'), ['beep', { op: '&>' }, { op: '>' }, 'boop'], 'partly separated');
t.same(parse('beep \\&\\>\\> boop'), ['beep', '&>>', 'boop'], 'escaped');
t.same(parse('beep "&>>" boop'), ['beep', '&>>', 'boop'], 'quoted');
t.same(parse('beep &>> boop', {}, { escape: '^' }), ['beep', { op: '&>>' }, 'boop'], 'with a custom escape');
t.same(parse('beep ^&^>^> boop', {}, { escape: '^' }), ['beep', '&>>', 'boop'], 'escaped with a custom escape');
t.same(parse('beep &>>> boop'), ['beep', { op: '&>>' }, { op: '>' }, 'boop']);
t.same(parse('beep &&>> boop'), ['beep', { op: '&&' }, { op: '>>' }, 'boop'], '`&&` wins over `&>>`');
t.end();
});
test('case clause fall-through', function (t) {
t.same(
parse('case x in a) beep ;& b) boop ;; esac'),
['case', 'x', 'in', 'a', { op: ')' }, 'beep', { op: ';&' }, 'b', { op: ')' }, 'boop', { op: ';;' }, 'esac']
);
t.same(parse('beep;&boop'), ['beep', { op: ';&' }, 'boop']);
t.same(parse('beep ; & boop'), ['beep', { op: ';' }, { op: '&' }, 'boop'], 'separated');
t.same(parse('beep \\;\\& boop'), ['beep', ';&', 'boop'], 'escaped');
t.same(parse('beep ";&" boop'), ['beep', ';&', 'boop'], 'quoted');
t.same(parse('beep ;& boop', {}, { escape: '^' }), ['beep', { op: ';&' }, 'boop'], 'with a custom escape');
t.same(parse('beep ^;^& boop', {}, { escape: '^' }), ['beep', ';&', 'boop'], 'escaped with a custom escape');
t.same(parse('beep ;&& boop'), ['beep', { op: ';&' }, { op: '&' }, 'boop'], '`;&` wins over `&&`');
t.same(parse('beep ;&> boop'), ['beep', { op: ';&' }, { op: '>' }, 'boop'], '`;&` wins over `&>`');
t.same(parse('beep &; boop'), ['beep', { op: '&' }, { op: ';' }, 'boop'], '`&;` is not an operator');
t.end();
});
test('case clause that tests the next pattern', function (t) {
t.same(
parse('case x in a) beep ;;& b) boop ;; esac'),
['case', 'x', 'in', 'a', { op: ')' }, 'beep', { op: ';;&' }, 'b', { op: ')' }, 'boop', { op: ';;' }, 'esac']
);
t.same(parse('beep;;&boop'), ['beep', { op: ';;&' }, 'boop']);
t.same(parse('beep ;; & boop'), ['beep', { op: ';;' }, { op: '&' }, 'boop'], 'separated');
t.same(parse('beep ; ;& boop'), ['beep', { op: ';' }, { op: ';&' }, 'boop'], 'partly separated');
t.same(parse('beep \\;\\;\\& boop'), ['beep', ';;&', 'boop'], 'escaped');
t.same(parse('beep ";;&" boop'), ['beep', ';;&', 'boop'], 'quoted');
t.same(parse('beep ;;& boop', {}, { escape: '^' }), ['beep', { op: ';;&' }, 'boop'], 'with a custom escape');
t.same(parse('beep ^;^;^& boop', {}, { escape: '^' }), ['beep', ';;&', 'boop'], 'escaped with a custom escape');
t.same(parse('beep ;;&& boop'), ['beep', { op: ';;&' }, { op: '&' }, 'boop'], '`;;&` wins over `&&`');
t.same(parse('beep ;;; boop'), ['beep', { op: ';;' }, { op: ';' }, 'boop']);
t.same(parse('beep ;;;& boop'), ['beep', { op: ';;' }, { op: ';&' }, 'boop']);
t.end();
});
test('glob patterns', function (t) {
t.same(
parse('tap test/*.test.js'),
['tap', { op: 'glob', pattern: 'test/*.test.js' }]
);
t.same(parse('tap "test/*.test.js"'), ['tap', 'test/*.test.js']);
t.end();
});
ljharb-shell-quote-2ec0702/test/parse.js 0000664 0000000 0000000 00000030132 15257741626 0020205 0 ustar 00root root 0000000 0000000 'use strict';
var test = require('tape');
var parse = require('../').parse;
var quote = require('../').quote;
test('parse shell commands', function (t) {
t.same(parse(''), [], 'parses an empty string');
t['throws'](
function () { parse('${}'); },
Error,
'empty substitution throws'
);
t['throws'](
function () { parse('${'); },
Error,
'incomplete substitution throws'
);
t.same(parse('a \'b\' "c"'), ['a', 'b', 'c']);
t.same(
parse('beep "boop" \'foo bar baz\' "it\'s \\"so\\" groovy"'),
['beep', 'boop', 'foo bar baz', 'it\'s "so" groovy']
);
t.same(parse('a b\\ c d'), ['a', 'b c', 'd']);
t.same(parse('\\$beep bo\\`op'), ['$beep', 'bo`op']);
t.same(parse('echo "foo = \\"foo\\""'), ['echo', 'foo = "foo"']);
t.same(parse(''), []);
t.same(parse(' '), []);
t.same(parse('\t'), []);
t.same(parse('a"b c d"e'), ['ab c de']);
t.same(parse('a\\ b"c d"\\ e f'), ['a bc d e', 'f']);
t.same(parse('a\\ b"c d"\\ e\'f g\' h'), ['a bc d ef g', 'h']);
t.same(parse("x \"bl'a\"'h'"), ['x', "bl'ah"]);
// inside single quotes everything is literal, so a backslash does not escape
// the closing quote and a quoted token must end at its first closing quote
t.same(parse("'\\' '\\'"), ['\\', '\\'], 'single-quoted backslashes parse as two separate tokens');
t.same(parse("'\\'\\''"), ["\\'"], 'single-quoted backslash joined with an escaped quote');
t.same(parse(quote(['\\', '\\'])), ['\\', '\\'], 'quote/parse round-trips a pair of backslashes');
t.same(parse("x bl^'a^'h'", {}, { escape: '^' }), ['x', "bl'a'h"]);
t.same(parse('abcH def', {}, { escape: 'H' }), ['abc def']);
t.deepEqual(parse('# abc def ghi'), [{ comment: ' abc def ghi' }], 'start-of-line comment content is unparsed');
t.deepEqual(parse('xyz # abc def ghi'), ['xyz', { comment: ' abc def ghi' }], 'comment content is unparsed');
t.deepEqual(parse('-x "" -y'), ['-x', '', '-y'], 'empty string is preserved');
t.same(
parse('2;b', {}, { escape: 'd' }),
[{ op: '2;b' }],
'control char in unquoted context mid-token with regex-special escape returns op'
);
t.end();
});
test('single quotes are literal', function (t) {
t.same(parse("'\\'\\'"), ["\\'"], 'close-escape-reopen produces a quote after a quoted backslash');
t.same(parse("'a'\\''b'"), ["a'b"], 'close-escape-reopen embeds a quote mid-word');
t.same(parse("'\\'x"), ['\\x'], 'bareword joins a preceding quoted backslash');
t.same(parse("a'\\'b"), ['a\\b'], 'quoted backslash joins surrounding barewords');
t.same(parse("''"), [''], 'empty single quotes produce an empty token');
t.same(parse("''a''"), ['a'], 'empty single quotes join adjacent content');
t.same(parse("'*'"), ['*'], 'quoted glob char is a plain string, not a glob');
t.end();
});
test('unmatched single quotes', function (t) {
// real shells reject unterminated quotes; parse is lenient, and these pin the shape of that leniency
t.same(parse("'"), [], 'a lone quote is dropped');
t.same(parse("'a"), ['a'], 'an unterminated quote keeps its content');
t.same(parse("a'b"), ['a', 'b'], 'an unmatched quote mid-word splits the token');
t.end();
});
test('an escaped backslash does not escape the character after it', function (t) {
t.same(parse('a\\\\ b'), ['a\\', 'b'], 'a space after an escaped backslash separates words');
t.same(parse('a\\\\;echo b'), ['a\\', { op: ';' }, 'echo', 'b'], 'a `;` after an escaped backslash is an operator');
t.same(parse('x\\\\|cat'), ['x\\', { op: '|' }, 'cat'], 'a `|` after an escaped backslash is an operator');
t.same(parse('a\\\\"b c"'), ['a\\b c'], 'a `"` after an escaped backslash opens a quoted string');
t.same(parse('"a\\\\" b'), ['a\\', 'b'], 'an escaped backslash does not escape a closing `"`');
t.same(parse('"a\\\\" "b"'), ['a\\', 'b'], 'a double-quoted string ends at its first unescaped `"`');
t.same(parse('"a\\\\";echo "b"'), ['a\\', { op: ';' }, 'echo', 'b'], 'a `;` after a closing `"` is an operator');
t.same(parse('"a\\\\\\"b" c'), ['a\\"b', 'c'], 'an escaped backslash then an escaped `"` inside double quotes');
t.same(parse('\\\\\\ y'), ['\\ y'], 'an escaped backslash then an escaped space');
t.same(
parse('dir "C:\\Program Files\\"', {}, { escape: '^' }),
['dir', 'C:\\Program Files\\'],
'with a custom escape, a backslash before a closing `"` is literal'
);
t.end();
});
test('double-quoted strings stay linear with a custom escape', function (t) {
// a double-quote pattern that ignores the custom escape rescans to the end at every `"`
var input = new Array(1e5 + 1).join('\\"');
t.same(parse(input, {}, { escape: '^' }), [new Array(1e5 + 1).join('\\')], 'one word of backslashes');
t.end();
});
test('nested parameter expansion', function (t) {
t.same(parse('${a${b}c}'), [''], 'a nested ${} is consumed as one substitution, not split at the first }');
t.same(parse('${a${b}}'), [''], 'a nested ${} at the end is consumed as one substitution');
t.same(parse('${foo{bar}'), [''], 'a lone { that is not part of a nested ${} does not change brace depth');
t.same(
parse('level=${levels[$RANDOM%${#levels[@]}]}'),
['level='],
'a nested array-index expansion is consumed whole, without leaking a partial token'
);
t.end();
});
test('splitUnquoted: field-splits unquoted variable expansion (#1)', function (t) {
var env = { T: 'c d', E: '', S: ' c d ', W: ' ' };
var opts = { splitUnquoted: true };
t.same(parse('test a b $T', env, opts), ['test', 'a', 'b', 'c', 'd'], 'unquoted expansion splits into separate tokens');
t.same(parse('a$T', env, opts), ['ac', 'd'], 'the first field joins the preceding text');
t.same(parse('$T x', env, opts), ['c', 'd', 'x'], 'the last field is a token of its own');
t.same(parse('x${T}y', env, opts), ['xc', 'dy'], 'fields join text on both sides');
t.same(parse('$S', env, opts), ['c', 'd'], 'leading, trailing, and repeated whitespace collapses');
t.same(parse('a$S', env, opts), ['a', 'c', 'd'], 'leading whitespace closes the preceding field');
t.same(parse('$W', env, opts), [], 'an all-whitespace expansion produces no tokens');
t.same(parse('a$W b', env, opts), ['a', 'b'], 'an all-whitespace expansion just separates fields');
t.same(parse('$E', env, opts), [], 'an empty unquoted expansion produces no token');
t.same(parse('"$T"', env, opts), ['c d'], 'a quoted expansion is never split');
t.same(parse('-x "" -y', env, opts), ['-x', '', '-y'], 'a quoted empty string is still preserved');
t.same(parse('a $F b', function () { return 'c d'; }, opts), ['a', 'c', 'd', 'b'], 'the env-function path splits too');
t.same(parse('test a b $T', env), ['test', 'a', 'b', 'c d'], 'without the option, unquoted expansion is not split');
t.end();
});
test('splitUnquoted: a string value is a custom IFS (#1)', function (t) {
function o(ifs) { return { splitUnquoted: ifs }; }
t.same(parse('${V}', { V: 'a:b' }, o(':')), ['a', 'b'], 'a non-whitespace IFS char splits fields');
t.same(parse('${V}', { V: 'a::b' }, o(':')), ['a', '', 'b'], 'adjacent non-whitespace delimiters yield an empty field');
t.same(parse('${V}', { V: ':a:' }, o(':')), ['', 'a'], 'a leading delimiter yields a leading empty; a trailing one does not');
t.same(parse('${V}', { V: 'a::' }, o(':')), ['a', ''], 'a trailing double delimiter yields one empty field');
t.same(parse('${V}', { V: ':' }, o(':')), [''], 'a lone delimiter yields a single empty field');
t.same(parse('${V}', { V: '::' }, o(':')), ['', ''], 'two delimiters yield two empty fields');
t.same(parse('${V}${W}', { V: 'a:', W: ':b' }, o(':')), ['a', '', 'b'], 'delimiters spanning an expansion boundary merge into one run');
t.same(parse('a${V}${W}z', { V: ':x:', W: ':y:' }, o(':')), ['a', 'x', '', 'y', 'z'], 'fields join literal text on both sides across expansions');
t.same(parse('${V}', { V: 'a : b' }, o(' :')), ['a', 'b'], 'whitespace around a non-whitespace delimiter is absorbed');
t.same(parse('${V}', { V: 'a b:c' }, o(' :')), ['a', 'b', 'c'], 'mixed IFS: whitespace and non-whitespace each delimit');
t.same(parse('${V}', { V: 'a,b' }, o(',')), ['a', 'b'], 'any character can be the IFS');
t.same(parse('${V}', { V: 'a b' }, o('')), ['a b'], 'an empty IFS string disables splitting');
t.end();
});
test('parse stays linear in token count (GHSA-395f-4hp3-45gv)', function (t) {
// the old concat-in-reduce finalizer was O(n^2): this many tokens took
// ~minutes, so under the unfixed code this test hangs rather than passes
var n = 2e5;
var input = new Array(n + 1).join('x '); // avoid String#repeat for old engines
var words = parse(input);
t.equal(words.length, n, 'every token is returned');
t.equal(words[0], 'x', 'first token is correct');
t.equal(words[n - 1], 'x', 'last token is correct');
var withEnv = parse(input, function () { return 'v'; });
t.equal(withEnv.length, n, 'env-function path returns every token');
t.end();
});
test('ANSI-C quoting', function (t) {
t.same(parse('$\'\''), [''], 'empty ANSI-C string');
t.same(parse('$\'abc\''), ['abc'], 'plain ANSI-C string');
t.same(parse('echo $\'it\\\'s\''), ['echo', 'it\'s'], 'an escaped quote does not end the string');
t.same(parse('$\'{"a":"${field}"}\''), ['{"a":"${field}"}'], 'variables are not expanded');
t.same(parse('$\'$HOME\'', { HOME: '/home/robot' }), ['$HOME'], 'env is not consulted');
t.same(parse('$\'cost is $5\''), ['cost is $5'], 'no word splitting, no expansion');
t.same(parse('foo$\'\\n\'bar'), ['foo\nbar'], 'mid-token ANSI-C string');
t.same(parse('a $\'x\' b'), ['a', 'x', 'b'], 'standalone ANSI-C string is its own word');
t.same(parse('$\'line1\\nline2\''), ['line1\nline2'], '\\n is decoded');
t.same(parse('$\'tab\\there\''), ['tab\there'], '\\t is decoded');
t.same(parse('$\'\\x41\''), ['A'], '\\xHH is decoded');
t.same(parse('$\'\\x4\''), ['\u0004'], 'a single hex digit is decoded');
t.same(parse('$\'\\101\''), ['A'], 'octal escapes are decoded');
t.same(parse('$\'\\u0041\''), ['A'], '\\uHHHH is decoded');
t.same(parse('$\'\\U0001F600\''), ['\uD83D\uDE00'], '\\UHHHHHHHH is decoded, as a surrogate pair');
t.same(parse('$\'\\U00110000\''), ['\\U00110000'], 'an out of range \\U escape is left alone');
t.same(parse('$\'\\e\''), ['\u001B'], '\\e is ESC');
t.same(parse('$\'\\ca\''), ['\u0001'], '\\ca is a control character');
t.same(parse('$\'\\c?\''), ['\u007F'], '\\c? is DEL');
t.same(parse('$\'a\\"b\''), ['a"b'], '\\" is a double quote');
t.same(parse('$\'a\\\\b\''), ['a\\b'], 'a doubled backslash is a backslash');
t.same(parse('$\'a\\zb\''), ['a\\zb'], 'an unrecognized escape keeps its backslash');
t.same(parse('$\'\\xzz\''), ['\\xzz'], '\\x with no hex digits keeps its backslash');
t.same(parse('"a$\'\\n\'b"'), ['a$\'\\n\'b'], 'not special inside double quotes');
t.end();
});
test('ANSI-C quoting: word boundaries and edge cases', function (t) {
t.same(parse('a$\'x\\\' y\''), ['ax\' y'], 'an escaped quote mid-word does not end the string');
t.same(parse('x$\'a\\\'b\' | c \'z\''), ['xa\'b', { op: '|' }, 'c', 'z'], 'an operator after a mid-word ANSI-C string is an operator');
t.same(parse('a$\'x\\\' ; y\''), ['ax\' ; y'], 'a `;` inside an ANSI-C string is not an operator');
t.same(parse('x\\\\$\'it\\\'s\' y'), ['x\\it\'s', 'y'], 'an ANSI-C string after an escaped backslash');
t.same(parse('$\'abc\\\''), ['$abc\\'], 'an unterminated ANSI-C string is not decoded');
t.same(parse('$A$\'x\'', { A: 'a ' }, { splitUnquoted: true }), ['a', 'x'], 'a pending field split ends before an ANSI-C string');
t.same(parse('a $\'\' b', {}, { splitUnquoted: true }), ['a', '', 'b'], 'an empty ANSI-C string is an empty word');
t.same(parse('$\'a\\0b\'c'), ['ac'], 'a NUL ends the string, as in bash');
t.same(parse('$\'\\477\''), ['?'], 'octal escapes are masked to 8 bits');
t.same(parse('$\'\\c\\\\\''), ['\u001C'], '\\c\\\\ is one control character');
t.same(parse('$\'a\\c\''), ['a\\c'], 'a trailing \\c keeps its backslash');
t.same(parse('$\'a\\nb\'', {}, { escape: '^' }), ['a\nb'], 'a backslash is always the escape inside $\'...\'');
t.end();
});
test('ANSI-C quoting stays linear on an unterminated string', function (t) {
// an ambiguous body pattern backtracks exponentially here, so this would hang rather than fail
var backslashes = new Array(1e5 + 1).join('\\');
t.same(parse('$\'' + backslashes), ['$', backslashes.slice(5e4)], 'an unterminated $\' then 100000 backslashes');
t.end();
});
ljharb-shell-quote-2ec0702/test/quote.js 0000664 0000000 0000000 00000024142 15257741626 0020234 0 ustar 00root root 0000000 0000000 'use strict';
var test = require('tape');
var execFile = require('child_process').execFile;
var quote = require('../').quote;
var parse = require('../').parse;
test('quote', function (t) {
t.equal(quote(['a', 'b', 'c d']), 'a b \'c d\'');
t.equal(
quote(['a', 'b', "it's a \"neat thing\""]),
'a b "it\'s a \\"neat thing\\""'
);
t.equal(
quote(['$', '`', '\'']),
'\\$ \\` "\'"'
);
t.equal(quote([]), '');
t.equal(quote(['a\nb']), "'a\nb'");
t.equal(quote([' #(){}*|][!']), "' #(){}*|][!'");
t.equal(quote(["'#(){}*|][!"]), "''\"'\"'#(){}*|][!'");
t.equal(quote(['X#(){}*|][!']), 'X\\#\\(\\)\\{\\}\\*\\|\\]\\[\\!');
t.equal(quote(['a\n#\nb']), "'a\n#\nb'");
t.equal(quote(['><;{}']), '\\>\\<\\;\\{\\}');
t.equal(quote(['a', 1, true, false]), 'a 1 true false');
t.equal(quote(['a', 1, null, undefined]), 'a 1 null undefined');
t.equal(quote(['a\\x']), "'a\\x'");
t.equal(quote(['a"b']), '\'a"b\'');
t.equal(quote(['"a"b"']), '\'"a"b"\'');
t.equal(quote(['a\\"b']), '\'a\\"b\'');
t.equal(quote(['a\\b']), '\'a\\b\'');
t.end();
});
test('quote tilde (escapes every ~ to prevent shell tilde-expansion)', function (t) {
t.equal(quote(['~']), '\\~');
t.equal(quote(['~/foo']), '\\~/foo');
t.equal(quote(['~root']), '\\~root');
t.equal(quote(['~root/x']), '\\~root/x');
t.equal(quote(['~+']), '\\~+');
t.equal(quote(['~-']), '\\~-');
t.equal(quote(['a~b']), 'a\\~b');
t.equal(quote(['x~']), 'x\\~');
t.end();
});
test('backslash with whitespace is not doubled in single quotes (#14)', function (t) {
t.equal(quote(['foo \\ bar']), "'foo \\ bar'", 'a backslash between spaces stays a single literal backslash');
t.equal(quote(['foo \\\\ bar']), "'foo \\\\ bar'", 'a double backslash is preserved, not quadrupled');
t.equal(quote(['foo\\\nbar']), "'foo\\\nbar'", 'a backslash before a newline is preserved');
t.end();
});
test('escapes shell-special characters conservatively (issue #11)', function (t) {
t.equal(quote(['make', 'CFLAGS=-DRELEASE']), 'make CFLAGS\\=-DRELEASE', 'escapes = so a leading word is not read as an assignment');
t.equal(quote(['a@b']), 'a\\@b', 'escapes @ (zsh globbing)');
t.equal(quote(['a^b']), 'a\\^b', 'escapes ^ (zsh extendedglob, csh)');
t.equal(quote(['a:b']), 'a\\:b', 'escapes :');
t.equal(quote(['a,b']), 'a\\,b', 'escapes , (brace expansion)');
t.equal(quote(['a!b']), 'a\\!b', 'escapes ! (history expansion / pipeline negation)');
t.end();
});
var apostropheBangValues = ["O'Brien!", "'!", "a\\'!b", 'O\'Brien! "$HOME" `printf unexpected`;\n[*]'];
test('quote apostrophes with exclamation marks', function (t) {
t.equal(quote(["O'Brien!"]), "'O'\"'\"'Brien!'");
t.equal(quote(['plain', "O'Brien!", '']), "plain 'O'\"'\"'Brien!' ''");
t.same(parse(quote(apostropheBangValues)), apostropheBangValues, 'quoted values round-trip through parse');
t.end();
});
test('apostrophes and exclamation marks survive a POSIX shell', { skip: process.platform === 'win32' }, function (t) {
execFile('/bin/sh', ['-c', "printf '%s\\0' " + quote(apostropheBangValues)], function (err, stdout) {
t.error(err, 'the shell exits cleanly');
t.same(stdout.split('\0').slice(0, -1), apostropheBangValues, 'the shell receives the original arguments');
t.end();
});
});
test('quote ops', function (t) {
t.equal(quote(['a', { op: '|' }, 'b']), 'a \\| b');
t.equal(
quote(['a', { op: '&&' }, 'b', { op: ';' }, 'c']),
'a \\&\\& b \\; c'
);
t.end();
});
test('quote windows paths', { skip: 'breaking change, disabled until 2.x' }, function (t) {
var path = 'C:\\projects\\node-shell-quote\\index.js';
t.equal(quote([path, 'b', 'c d']), 'C:\\projects\\node-shell-quote\\index.js b \'c d\'');
t.end();
});
test("chars for windows paths don't break out", function (t) {
var x = '`:\\a\\b';
t.equal(quote([x]), "'`:\\a\\b'");
t.end();
});
test('empty strings', function (t) {
t.equal(quote(['-x', '', 'y']), '-x \'\' y');
t.end();
});
test('quote ops: allowlist', function (t) {
var ops = ['||', '&&', ';;', '|&', '<(', '<<<', '>>', '>&', '<&', '&', ';', '(', ')', '|', '<', '>'];
for (var i = 0; i < ops.length; i++) {
var op = ops[i];
var expected = '';
for (var j = 0; j < op.length; j++) { expected += '\\' + op.charAt(j); }
t.equal(quote([{ op: op }]), expected, 'op ' + op);
}
t.end();
});
test('quote ops: here documents', function (t) {
t.equal(quote([{ op: '<<' }]), '\\<\\<');
t.equal(quote(parse('cat << EOF')), 'cat \\<\\< EOF');
t.end();
});
test('quote ops: here documents that strip leading tabs', function (t) {
t.equal(quote([{ op: '<<-' }]), '\\<\\<\\-');
t.equal(quote(parse('cat <<-EOF')), 'cat \\<\\<\\- EOF');
t.end();
});
test('quote ops: opening a file for reading and writing', function (t) {
t.equal(quote([{ op: '<>' }]), '\\<\\>');
t.equal(quote(parse('beep <> boop')), 'beep \\<\\> boop');
t.end();
});
test('quote ops: redirecting output despite noclobber', function (t) {
t.equal(quote([{ op: '>|' }]), '\\>\\|');
t.equal(quote(parse('beep >| boop')), 'beep \\>\\| boop');
t.end();
});
test('quote ops: output process substitution', function (t) {
t.equal(quote([{ op: '>(' }]), '\\>\\(');
t.equal(quote(parse('beep >(boop)')), 'beep \\>\\( boop \\)');
t.end();
});
test('quote ops: redirecting stdout and stderr', function (t) {
t.equal(quote([{ op: '&>' }]), '\\&\\>');
t.equal(quote(parse('beep &> boop')), 'beep \\&\\> boop');
t.end();
});
test('quote ops: appending stdout and stderr', function (t) {
t.equal(quote([{ op: '&>>' }]), '\\&\\>\\>');
t.equal(quote(parse('beep &>> boop')), 'beep \\&\\>\\> boop');
t.end();
});
test('quote ops: case clause fall-through', function (t) {
t.equal(quote([{ op: ';&' }]), '\\;\\&');
t.equal(quote(parse('beep ;& boop')), 'beep \\;\\& boop');
t.end();
});
test('quote ops: case clause that tests the next pattern', function (t) {
t.equal(quote([{ op: ';;&' }]), '\\;\\;\\&');
t.equal(quote(parse('beep ;;& boop')), 'beep \\;\\;\\& boop');
t.end();
});
test('quote ops: rejects line terminators (GHSA-w7jw-789q-3m8p)', function (t) {
t['throws'](function () { quote([{ op: ';\nid' }]); }, TypeError, 'newline in op');
t['throws'](function () { quote([{ op: ';\rid' }]); }, TypeError, 'carriage return in op');
t['throws'](function () { quote([{ op: ';\u2028id' }]); }, TypeError, 'U+2028 in op');
t['throws'](function () { quote([{ op: ';\u2029id' }]); }, TypeError, 'U+2029 in op');
t.end();
});
test('quote ops: rejects non-allowlisted values', function (t) {
t['throws'](function () { quote([{ op: '' }]); }, TypeError, 'empty op');
t['throws'](function () { quote([{ op: 'foo' }]); }, TypeError, 'arbitrary string');
t['throws'](function () { quote([{ op: '|||' }]); }, TypeError, 'near-miss');
t['throws'](function () { quote([{ op: 42 }]); }, TypeError, 'non-string op');
t.end();
});
test('quote glob pattern', function (t) {
t.equal(quote([{ op: 'glob', pattern: 'test/*.test.js' }]), 'test/*.test.js');
t.equal(quote([{ op: 'glob', pattern: '?ab' }]), '?ab');
t.equal(quote([{ op: 'glob', pattern: '[ab]c' }]), '[ab]c');
t.equal(quote([{ op: 'glob', pattern: '{a,b}' }]), '{a,b}');
t.equal(quote([{ op: 'glob', pattern: 'my dir/*.txt' }]), 'my\\ dir/*.txt');
t.equal(quote([{ op: 'glob', pattern: 'a$b' }]), 'a\\$b');
t['throws'](function () { quote([{ op: 'glob' }]); }, TypeError, 'missing pattern');
t['throws'](function () { quote([{ op: 'glob', pattern: 'a\nb' }]); }, TypeError, 'newline in pattern');
t['throws'](function () { quote([{ op: 'glob', pattern: 'a\u2028b' }]); }, TypeError, 'U+2028 in pattern');
t.end();
});
test('quote glob: an empty pattern is an empty argument, not a dropped one', function (t) {
t.equal(quote([{ op: 'glob', pattern: '' }]), '\'\'', 'an empty pattern quotes to an empty argument');
t.equal(
quote(['cmd', { op: 'glob', pattern: '' }, 'after']),
'cmd \'\' after',
'an empty pattern keeps its argv slot instead of vanishing'
);
t.end();
});
test('quote glob tilde (escapes every ~ to prevent shell tilde-expansion)', function (t) {
t.equal(quote([{ op: 'glob', pattern: '~/*.txt' }]), '\\~/*.txt', 'glob metas still pass through');
t.equal(quote([{ op: 'glob', pattern: '~root/.bashr*' }]), '\\~root/.bashr*');
t.equal(quote([{ op: 'glob', pattern: '~+/*' }]), '\\~+/*');
t.equal(quote([{ op: 'glob', pattern: '~-/*' }]), '\\~-/*');
t.equal(quote([{ op: 'glob', pattern: '~x*' }]), '\\~x*');
t.equal(quote([{ op: 'glob', pattern: 'a~b*' }]), 'a\\~b*');
t.end();
});
test('quote comment', function (t) {
t.equal(quote(['echo', 'hi', { comment: ' a comment' }]), 'echo hi # a comment');
t.equal(quote([{ comment: '' }]), '#');
t['throws'](function () { quote([{ comment: 'a\nb' }]); }, TypeError, 'newline in comment');
t['throws'](function () { quote([{ comment: 'a\rb' }]); }, TypeError, 'CR in comment');
t['throws'](function () { quote([{ comment: 'a\u2028b' }]); }, TypeError, 'U+2028 in comment');
t.end();
});
test('quote comment: rejects line terminators in later tokens', function (t) {
t['throws'](function () { quote(['echo', { comment: 'x' }, 'a\nid;#']); }, TypeError, 'newline after a comment');
t['throws'](function () { quote(['echo', { comment: 'x' }, 'a\rb']); }, TypeError, 'CR after a comment');
t['throws'](function () { quote(['echo', { comment: 'x' }, 'a\u2028b']); }, TypeError, 'U+2028 after a comment');
t['throws'](function () { quote(['echo', { comment: 'x' }, 'a\u2029b']); }, TypeError, 'U+2029 after a comment');
t['throws'](
function () { quote(['echo', { comment: 'x' }, 'ok', 'it\'s\nid;#']); },
TypeError,
'newline in any later token, not just the next one'
);
t['throws'](
function () { quote(parse('curl http://x/#frag').concat('a\nid;#')); },
TypeError,
'a mid-word `#` from parse, followed by an appended token'
);
t.equal(quote(['echo', 'a\nb', { comment: 'x' }]), 'echo \'a\nb\' #x', 'a line terminator before a comment is fine');
t.equal(quote(['echo', { comment: 'x' }, 'y']), 'echo #x y', 'later tokens without line terminators are unchanged');
t.end();
});
test('quote rejects unrecognized object shapes', function (t) {
t['throws'](function () { quote([{}]); }, TypeError, 'empty object');
t['throws'](function () { quote([{ foo: 'bar' }]); }, TypeError, 'unknown key');
t['throws'](function () { quote([{ op: null }]); }, TypeError, 'null op');
t.end();
});
ljharb-shell-quote-2ec0702/test/set.js 0000664 0000000 0000000 00000001065 15257741626 0017671 0 ustar 00root root 0000000 0000000 'use strict';
var test = require('tape');
var parse = require('../').parse;
test('set env vars', function (t) {
t.same(
parse('ABC=444 x y z'),
['ABC=444', 'x', 'y', 'z']
);
t.same(
parse('ABC=3\\ 4\\ 5 x y z'),
['ABC=3 4 5', 'x', 'y', 'z']
);
t.same(
parse('X="7 8 9" printx'),
['X=7 8 9', 'printx']
);
t.same(
parse('X="7 8 9"; printx'),
['X=7 8 9', { op: ';' }, 'printx']
);
t.same(
parse('X="7 8 9"; printx', function () {
t.fail('should not have matched any keys');
}),
['X=7 8 9', { op: ';' }, 'printx']
);
t.end();
});
ljharb-shell-quote-2ec0702/tsconfig.json 0000664 0000000 0000000 00000000173 15257741626 0020267 0 ustar 00root root 0000000 0000000 {
"extends": "@ljharb/tsconfig",
"compilerOptions": {
"target": "ES2021"
},
"exclude": [
"coverage",
"test"
]
}