@dotenvx/dotenvx 1.18.0 → 1.18.1

package/CHANGELOG.md

@@ -2,13 +2,19 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-## [Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.18.0...main)
+## [Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.18.1...main)
+
+## 1.18.1
+
+### Added
+
+* escape user inputted regex groupings like `$1` or `$2`. ([#396](https://github.com/dotenvx/dotenvx/pull/396))
 
 ## 1.18.0
 
 ### Added
 
-* `set` and `encrypt` preserve leading spaces ([#395](https://github.com/dotenvx/dotenvx/pull/395/))
+* `set` and `encrypt` preserve leading spaces ([#395](https://github.com/dotenvx/dotenvx/pull/395))
 
 ```sh
      HELLO=world

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.18.0",
+  "version": "1.18.1",
   "name": "@dotenvx/dotenvx",
   "description": "a better dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/lib/helpers/escapeDollarSigns.js

@@ -0,0 +1,5 @@
+function escapeDollarSigns (str) {
+  return str.replace(/\$/g, '$$$$')
+}
+
+module.exports = escapeDollarSigns

package/src/lib/helpers/replace.js

@@ -2,10 +2,12 @@ const util = require('util')
 const dotenv = require('dotenv')
 
 const escapeForRegex = require('./escapeForRegex')
+const escapeDollarSigns = require('./escapeDollarSigns')
 
 function replace (src, key, replaceValue) {
   let output
   let escapedValue = util.inspect(replaceValue, { showHidden: false, depth: null, colors: false })
+
   if (replaceValue.includes('\n')) {
     escapedValue = JSON.stringify(replaceValue) // use JSON stringify if string contains newlines
     escapedValue = escapedValue.replace(/\\n/g, '\n') // fix up newlines
@@ -38,9 +40,11 @@ function replace (src, key, replaceValue) {
       'gm' // (g)lobal (m)ultiline
     )
 
+    const saferInput = escapeDollarSigns(newPart) // cleanse user inputted capture groups ($1, $2 etc)
+
     // $1 preserves spaces
     // $2 preserves export
-    output = src.replace(currentPart, `$1$2${newPart}`)
+    output = src.replace(currentPart, `$1$2${saferInput}`)
   } else {
     // append
     if (src.endsWith('\n')) {