fix: handle inner quotes in double-quoted env values in .env file#32930
Merged
bartlomieju merged 3 commits intodenoland:mainfrom Mar 25, 2026
Merged
fix: handle inner quotes in double-quoted env values in .env file#32930bartlomieju merged 3 commits intodenoland:mainfrom
bartlomieju merged 3 commits intodenoland:mainfrom
Conversation
When a double-quoted value contains inner (unescaped) quotes like `KEY="foo'bar"baz`qux"`, the parser would stop at the first inner quote instead of treating the outermost quotes as the delimiters. Fix: introduce `find_closing_quote` which first tries the nearest matching quote. If there's non-whitespace content after it on the same line, inner quotes are present — fall back to the last matching quote on the line. This matches the behavior of the dotenv npm package. Also handles escaped newlines correctly within values that contain inner quotes. Closes denoland#32928 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- When content follows the first closing quote but contains no more matching quotes (e.g. KEY='VALUE'JUNK), use the first quote as the closer (matching Node.js/dotenv behavior) - Rename .env to env_file in spec test to avoid .gitignore exclusion Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes Deno’s --env-file dotenv parsing to correctly handle double-quoted values containing inner (unescaped) quotes, aligning behavior more closely with the dotenv npm package and preventing truncation/incorrect \n expansion in those cases.
Changes:
- Replace first-quote matching with a new
find_closing_quoteheuristic to prefer the “outermost” quote when inner quotes are detected. - Add new Rust unit tests in
libs/dotenvfor inner-quote parsing and\nexpansion behavior. - Add new spec tests under
tests/specs/eval/env_file_inner_quotes/to validate CLI behavior with--env-file.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
libs/dotenv/lib.rs |
Updates quote-closing detection and adds regression tests for inner quotes + newline escape expansion. |
tests/specs/eval/env_file_inner_quotes/env_file |
Adds .env fixture containing inner quotes and \n escape sequences. |
tests/specs/eval/env_file_inner_quotes/__test__.jsonc |
Adds spec tests validating deno eval --env-file outputs for the new fixture. |
The backward scan now prefers a quote candidate followed by a `#` comment (strong signal) over one followed by just whitespace/EOL. This correctly handles the edge case where an inline comment contains the same quote character, e.g. `KEY="a"b" # "comment"` now yields `a"b` instead of including the comment text. Also adds tests for same-type inner quotes and inline comments with inner quotes, and clarifies existing test comments. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
--env-fileparsing of double-quoted values containing inner(unescaped) quotes, e.g.
KEY="foo'bar"bazqux"`\nescape expansion in double-quoted values with inner quotes,e.g.
KEY="foo\ni am "on" newline"Root cause:
find_charfound the first matching"after the openingquote, which was an inner quote — truncating the value. The dotenv npm
package instead treats the outermost quotes as delimiters.
Fix: New
find_closing_quotefunction tries the nearest matchingquote first. If there's non-whitespace content after it on the same line,
inner quotes are present — it falls back to the last matching quote on the
line instead.
Closes #32928
Test plan
deno_dotenv:inner_quotes_in_double_quoted_valuesand
inner_single_quotes_preservedeval::env_file_inner_quotes(both inner_quotes andinner_quotes_with_newline)
🤖 Generated with Claude Code