Skip to content

Handle parentheses in secrets#1726

Merged
djmb merged 1 commit intomainfrom
handle-password-with-parens
Dec 1, 2025
Merged

Handle parentheses in secrets#1726
djmb merged 1 commit intomainfrom
handle-password-with-parens

Conversation

@djmb
Copy link
Collaborator

@djmb djmb commented Dec 1, 2025

Dotenv inline command substitutions incorrectly matches escaped parentheses when parsing commands, so let's replace its regex with one that doesn't.

This means that when you have a secrets file like:

SECRETS=$(kamal secrets fetch --adapter myadapter SECRET_WITH_PARENS)
SECRET_WITH_PARENS=$(kamal secrets extract SECRET_WITH_PARENS ${SECRETS})

Then we correctly add the secret even if it contains parentheses.

Currently if SECRET_WITH_PARENS=pass)word, then we get:

SECRET_WITH_PARENS=$(kamal secrets extract SECRET_WITH_PARENS pass\)word)

And dotenv's regex thinks the command is
kamal secrets extract SECRET_WITH_PARENS pass\.

Fixes: #1200

@djmb djmb force-pushed the handle-password-with-parens branch 2 times, most recently from 4e03db0 to e05cea9 Compare December 1, 2025 14:33
Dotenv inline command substitutions incorrectly matches escaped
parentheses when parsing commands, so let's replace its regex with one
that doesn't.

This means that when you have a secrets file like:

```
SECRETS=$(kamal secrets fetch --adapter myadapter SECRET_WITH_PARENS)
SECRET_WITH_PARENS=$(kamal secrets extract SECRET_WITH_PARENS ${SECRETS})
```

Then we correctly add the secret even if it contains parentheses.

Currently if SECRET_WITH_PARENS=pass)word, then we get:

```
SECRET_WITH_PARENS=$(kamal secrets extract SECRET_WITH_PARENS pass\)word)
```

And dotenv's regex thinks the command is
`kamal secrets extract SECRET_WITH_PARENS pass\`.
@djmb djmb force-pushed the handle-password-with-parens branch from e05cea9 to a4e82fa Compare December 1, 2025 14:55
@djmb djmb merged commit 6aa8548 into main Dec 1, 2025
10 checks passed
@djmb djmb deleted the handle-password-with-parens branch December 1, 2025 15:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Secrets with special chars rise error unexpected token at

2 participants