envlockup 0.2.0__tar.gz → 0.2.1__tar.gz

{envlockup-0.2.0 → envlockup-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: envlockup
-Version: 0.2.0
+Version: 0.2.1
 Summary: Read envlockup files from Python: encrypted .env files you can commit, decrypted with your SSH or age key.
 Project-URL: Homepage, https://github.com/denisbilli/envlockup
 Author: denisbilli

{envlockup-0.2.0 → envlockup-0.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "envlockup"
-version = "0.2.0"
+version = "0.2.1"
 description = "Read envlockup files from Python: encrypted .env files you can commit, decrypted with your SSH or age key."
 readme = "README.md"
 license = "MIT"

{envlockup-0.2.0 → envlockup-0.2.1}/src/envlockup/__init__.py

@@ -34,7 +34,7 @@ from .errors import (
     PassphraseRequiredError,
 )
 
-__version__ = "0.2.0"
+__version__ = "0.2.1"
 __all__ = [
     "config",
     "load",

{envlockup-0.2.0 → envlockup-0.2.1}/src/envlockup/__main__.py

@@ -10,6 +10,7 @@ import getpass
 import json
 import os
 import shutil
+import re
 import subprocess
 import sys
 from pathlib import Path
@@ -66,6 +67,19 @@ def _values(args: argparse.Namespace) -> dict[str, str]:
         return load(args.file, identity=args.identity, passphrase=passphrase)
 
 
+# cmd.exe metacharacters, escaped with ^ (the same rules as the npm CLI and cross-spawn).
+_CMD_META = re.compile(r"""([()\][%!^"`<>&|;, *?])""")
+
+
+def _cmd_escape(arg: str, twice: bool) -> str:
+    # Backslashes before a quote, or at the end (before the closing quote), are doubled.
+    quoted = '"' + re.sub(r"(\\*)$", r"\1\1", re.sub(r'(\\*)"', r'\1\1\\"', arg)) + '"'
+    quoted = _CMD_META.sub(r"^\1", quoted)
+    # A batch file that forwards its arguments with %* has cmd.exe parse them a
+    # second time, which removes one more level of escaping.
+    return _CMD_META.sub(r"^\1", quoted) if twice else quoted
+
+
 def _run(command: list[str], env: dict[str, str]) -> int:
     if os.name == "posix":
         # Replace this process, so the command gets signals and keeps our PID
@@ -78,6 +92,13 @@ def _run(command: list[str], env: dict[str, str]) -> int:
     # Windows: resolve .exe/.cmd through PATHEXT, then wait for the child.
     exe = shutil.which(command[0], path=env.get("PATH")) or command[0]
     try:
+        if re.search(r"\.(cmd|bat)$", exe, re.IGNORECASE):
+            # Batch files run through cmd.exe, which would interpret & | % and
+            # friends in the arguments: escape them, twice, since launchers pass
+            # them on with %*.
+            line = " ".join([_CMD_META.sub(r"^\1", exe), *(_cmd_escape(a, True) for a in command[1:])])
+            comspec = env.get("COMSPEC") or os.environ.get("COMSPEC") or "cmd.exe"
+            return subprocess.call(f'{comspec} /d /s /c "{line}"', env=env)
         return subprocess.call([exe, *command[1:]], env=env)
     except OSError as err:
         print(f"envlockup: cannot run {command[0]}: {err.strerror}", file=sys.stderr)

{envlockup-0.2.0 → envlockup-0.2.1}/tests/test_api.py

@@ -141,6 +141,24 @@ def test_cli_run(env_file, cli_env):
     assert json.loads(r.stdout)["EMPTY"] == ""
 
 
+TRICKY_ARGS = ["a&b", "50%", "%PATH%", "x^y", 'say "hi"', 'q"&"q', "back\\slash\\", "with space", "", "!bang!", "(p)", "a|b", "<lt>"]
+
+
+@pytest.mark.skipif(os.name != "nt", reason="Windows only")
+def test_cli_run_passes_arguments_unchanged_to_cmd_scripts(env_file, cli_env, tmp_path):
+    printer = tmp_path / "argv.py"
+    printer.write_text("import json, sys\nprint(json.dumps(sys.argv[1:]))\n", encoding="utf-8")
+    for sub in ("scripts", os.path.join("node_modules", ".bin")):
+        (tmp_path / sub).mkdir(parents=True, exist_ok=True)
+        script = tmp_path / sub / "argv.cmd"
+        script.write_text(f'@"{sys.executable}" "{printer}" %*\r\n', encoding="utf-8")
+        r = cli("run", "--", str(script), *TRICKY_ARGS, env=cli_env, cwd=env_file.parent)
+        assert r.returncode == 0, r.stderr
+        assert json.loads(r.stdout) == TRICKY_ARGS, sub
+    r = cli("run", "--", sys.executable, str(printer), *TRICKY_ARGS, env=cli_env, cwd=env_file.parent)
+    assert json.loads(r.stdout) == TRICKY_ARGS
+
+
 def test_cli_run_exit_code_and_missing_command(env_file, cli_env):
     r = cli("run", "--", sys.executable, "-c", "raise SystemExit(7)", env=cli_env, cwd=env_file.parent)
     assert r.returncode == 7