quote.js 5.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145
  1. 'use strict';
  2. var test = require('tape');
  3. var quote = require('../').quote;
  4. test('quote', function (t) {
  5. t.equal(quote(['a', 'b', 'c d']), 'a b \'c d\'');
  6. t.equal(
  7. quote(['a', 'b', "it's a \"neat thing\""]),
  8. 'a b "it\'s a \\"neat thing\\""'
  9. );
  10. t.equal(
  11. quote(['$', '`', '\'']),
  12. '\\$ \\` "\'"'
  13. );
  14. t.equal(quote([]), '');
  15. t.equal(quote(['a\nb']), "'a\nb'");
  16. t.equal(quote([' #(){}*|][!']), "' #(){}*|][!'");
  17. t.equal(quote(["'#(){}*|][!"]), '"\'#(){}*|][\\!"');
  18. t.equal(quote(['X#(){}*|][!']), 'X\\#\\(\\)\\{\\}\\*\\|\\]\\[\\!');
  19. t.equal(quote(['a\n#\nb']), "'a\n#\nb'");
  20. t.equal(quote(['><;{}']), '\\>\\<\\;\\{\\}');
  21. t.equal(quote(['a', 1, true, false]), 'a 1 true false');
  22. t.equal(quote(['a', 1, null, undefined]), 'a 1 null undefined');
  23. t.equal(quote(['a\\x']), "'a\\x'");
  24. t.equal(quote(['a"b']), '\'a"b\'');
  25. t.equal(quote(['"a"b"']), '\'"a"b"\'');
  26. t.equal(quote(['a\\"b']), '\'a\\"b\'');
  27. t.equal(quote(['a\\b']), '\'a\\b\'');
  28. t.end();
  29. });
  30. test('quote tilde (escapes every ~ to prevent shell tilde-expansion)', function (t) {
  31. t.equal(quote(['~']), '\\~');
  32. t.equal(quote(['~/foo']), '\\~/foo');
  33. t.equal(quote(['~root']), '\\~root');
  34. t.equal(quote(['~root/x']), '\\~root/x');
  35. t.equal(quote(['~+']), '\\~+');
  36. t.equal(quote(['~-']), '\\~-');
  37. t.equal(quote(['a~b']), 'a\\~b');
  38. t.equal(quote(['x~']), 'x\\~');
  39. t.end();
  40. });
  41. test('backslash with whitespace is not doubled in single quotes (#14)', function (t) {
  42. t.equal(quote(['foo \\ bar']), "'foo \\ bar'", 'a backslash between spaces stays a single literal backslash');
  43. t.equal(quote(['foo \\\\ bar']), "'foo \\\\ bar'", 'a double backslash is preserved, not quadrupled');
  44. t.equal(quote(['foo\\\nbar']), "'foo\\\nbar'", 'a backslash before a newline is preserved');
  45. t.end();
  46. });
  47. test('escapes shell-special characters conservatively (issue #11)', function (t) {
  48. t.equal(quote(['make', 'CFLAGS=-DRELEASE']), 'make CFLAGS\\=-DRELEASE', 'escapes = so a leading word is not read as an assignment');
  49. t.equal(quote(['a@b']), 'a\\@b', 'escapes @ (zsh globbing)');
  50. t.equal(quote(['a^b']), 'a\\^b', 'escapes ^ (zsh extendedglob, csh)');
  51. t.equal(quote(['a:b']), 'a\\:b', 'escapes :');
  52. t.equal(quote(['a,b']), 'a\\,b', 'escapes , (brace expansion)');
  53. t.equal(quote(['a!b']), 'a\\!b', 'escapes ! (history expansion / pipeline negation)');
  54. t.end();
  55. });
  56. test('quote ops', function (t) {
  57. t.equal(quote(['a', { op: '|' }, 'b']), 'a \\| b');
  58. t.equal(
  59. quote(['a', { op: '&&' }, 'b', { op: ';' }, 'c']),
  60. 'a \\&\\& b \\; c'
  61. );
  62. t.end();
  63. });
  64. test('quote windows paths', { skip: 'breaking change, disabled until 2.x' }, function (t) {
  65. var path = 'C:\\projects\\node-shell-quote\\index.js';
  66. t.equal(quote([path, 'b', 'c d']), 'C:\\projects\\node-shell-quote\\index.js b \'c d\'');
  67. t.end();
  68. });
  69. test("chars for windows paths don't break out", function (t) {
  70. var x = '`:\\a\\b';
  71. t.equal(quote([x]), "'`:\\a\\b'");
  72. t.end();
  73. });
  74. test('empty strings', function (t) {
  75. t.equal(quote(['-x', '', 'y']), '-x \'\' y');
  76. t.end();
  77. });
  78. test('quote ops: allowlist', function (t) {
  79. var ops = ['||', '&&', ';;', '|&', '<(', '<<<', '>>', '>&', '<&', '&', ';', '(', ')', '|', '<', '>'];
  80. for (var i = 0; i < ops.length; i++) {
  81. var op = ops[i];
  82. var expected = '';
  83. for (var j = 0; j < op.length; j++) { expected += '\\' + op.charAt(j); }
  84. t.equal(quote([{ op: op }]), expected, 'op ' + op);
  85. }
  86. t.end();
  87. });
  88. test('quote ops: rejects line terminators (GHSA-w7jw-789q-3m8p)', function (t) {
  89. t['throws'](function () { quote([{ op: ';\nid' }]); }, TypeError, 'newline in op');
  90. t['throws'](function () { quote([{ op: ';\rid' }]); }, TypeError, 'carriage return in op');
  91. t['throws'](function () { quote([{ op: ';\u2028id' }]); }, TypeError, 'U+2028 in op');
  92. t['throws'](function () { quote([{ op: ';\u2029id' }]); }, TypeError, 'U+2029 in op');
  93. t.end();
  94. });
  95. test('quote ops: rejects non-allowlisted values', function (t) {
  96. t['throws'](function () { quote([{ op: '' }]); }, TypeError, 'empty op');
  97. t['throws'](function () { quote([{ op: 'foo' }]); }, TypeError, 'arbitrary string');
  98. t['throws'](function () { quote([{ op: '|||' }]); }, TypeError, 'near-miss');
  99. t['throws'](function () { quote([{ op: 42 }]); }, TypeError, 'non-string op');
  100. t.end();
  101. });
  102. test('quote glob pattern', function (t) {
  103. t.equal(quote([{ op: 'glob', pattern: 'test/*.test.js' }]), 'test/*.test.js');
  104. t.equal(quote([{ op: 'glob', pattern: '?ab' }]), '?ab');
  105. t.equal(quote([{ op: 'glob', pattern: '[ab]c' }]), '[ab]c');
  106. t.equal(quote([{ op: 'glob', pattern: '{a,b}' }]), '{a,b}');
  107. t.equal(quote([{ op: 'glob', pattern: 'my dir/*.txt' }]), 'my\\ dir/*.txt');
  108. t.equal(quote([{ op: 'glob', pattern: 'a$b' }]), 'a\\$b');
  109. t['throws'](function () { quote([{ op: 'glob' }]); }, TypeError, 'missing pattern');
  110. t['throws'](function () { quote([{ op: 'glob', pattern: 'a\nb' }]); }, TypeError, 'newline in pattern');
  111. t['throws'](function () { quote([{ op: 'glob', pattern: 'a\u2028b' }]); }, TypeError, 'U+2028 in pattern');
  112. t.end();
  113. });
  114. test('quote comment', function (t) {
  115. t.equal(quote(['echo', 'hi', { comment: ' a comment' }]), 'echo hi # a comment');
  116. t.equal(quote([{ comment: '' }]), '#');
  117. t['throws'](function () { quote([{ comment: 'a\nb' }]); }, TypeError, 'newline in comment');
  118. t['throws'](function () { quote([{ comment: 'a\rb' }]); }, TypeError, 'CR in comment');
  119. t['throws'](function () { quote([{ comment: 'a\u2028b' }]); }, TypeError, 'U+2028 in comment');
  120. t.end();
  121. });
  122. test('quote rejects unrecognized object shapes', function (t) {
  123. t['throws'](function () { quote([{}]); }, TypeError, 'empty object');
  124. t['throws'](function () { quote([{ foo: 'bar' }]); }, TypeError, 'unknown key');
  125. t['throws'](function () { quote([{ op: null }]); }, TypeError, 'null op');
  126. t.end();
  127. });