fix(cli): escape single-quotes in dotenv key-values

packages/cli/src/__tests__/replace-all-placeholder-with-env.test.ts

@@ -5,7 +5,7 @@ afterEach(() => {
 });
 
 describe("replaceAllPlaceholderWithEnv", () => {
-  test("scriptPlaceholder (1)", () => {
+  test("scriptPlaceholder with basic code and env values", () => {
     // arrange
     const code = `JSON.parse('"import_meta_env_placeholder"')`;
     const env = {
@@ -22,7 +22,7 @@ describe("replaceAllPlaceholderWithEnv", () => {
     );
   });
 
-  test("scriptPlaceholder (2)", () => {
+  test("scriptPlaceholder with slashes for double quotes [1]", () => {
     // arrange
     const code = `JSON.parse('\\"import_meta_env_placeholder\\"')`;
 
@@ -40,7 +40,7 @@ describe("replaceAllPlaceholderWithEnv", () => {
     );
   });
 
-  test("scriptPlaceholder (3)", () => {
+  test("scriptPlaceholder with slashes for double quotes [2] and single quotes [1]", () => {
     // arrange
     const code = `JSON.parse(\\'\\\\"import_meta_env_placeholder\\\\"\\')`;
 
@@ -58,20 +58,38 @@ describe("replaceAllPlaceholderWithEnv", () => {
     );
   });
 
-  test("scriptPlaceholder (4)", () => {
+  test("scriptPlaceholder with escaped double quotes", () => {
     // arrange
     const code = `JSON.parse('"import_meta_env_placeholder"')`;
     const env = {
       KEY1: '{"child1":"value1"}',
       KEY2: '{"child2":"value2"}',
+      KEY3: '["value1", "value2"]',
     };
 
     // act
     const result = replaceAllPlaceholderWithEnv({ code, env });
 
     // assert
     expect(result).toMatchInlineSnapshot(
-      `"JSON.parse('{"KEY1":"{\\\\\\"child1\\\\\\":\\\\\\"value1\\\\\\"}","KEY2":"{\\\\\\"child2\\\\\\":\\\\\\"value2\\\\\\"}"}')"`,
+      `"JSON.parse('{"KEY1":"{\\\\\\"child1\\\\\\":\\\\\\"value1\\\\\\"}","KEY2":"{\\\\\\"child2\\\\\\":\\\\\\"value2\\\\\\"}","KEY3":"[\\\\\\"value1\\\\\\", \\\\\\"value2\\\\\\"]"}')"`
+    );
+  });
+
+  test("scriptPlaceholder with escaped single quotes", () => {
+    // arrange
+    const code = `JSON.parse('"import_meta_env_placeholder"')`;
+    const env = {
+      KEY1: "['value3', 'value4']",
+      KEY2: "This has 'single quotes' inside",
+    };
+
+    // act
+    const result = replaceAllPlaceholderWithEnv({ code, env });
+
+    // assert
+    expect(result).toMatchInlineSnapshot(
+      `"JSON.parse('{"KEY1":"[\\\'value3\\\', \\\'value4\\\']","KEY2":"This has \\\'single quotes\\\' inside"}')"`
     );
   });
 });

packages/cli/src/replace-all-placeholder-with-env.ts

@@ -10,28 +10,29 @@ export const replaceAllPlaceholderWithEnv = ({
 }): string => {
   const escapedEnv: Record<string, string> = {};
   for (const key of Object.keys(env)) {
-    escapedEnv[key] = env[key].replace(/"/g, '\\"');
+    escapedEnv[key] = env[key].replace(/"/g, '\\"').replace(/'/g, "\\'");
   }
+  const serializedEscapedEnv = serialize(escapedEnv).replace(/\\'/g, "'");
   return code
     .replace(
       createScriptPlaceholderRegExp({
         doubleQuoteSlashCount: 2,
         singleQuoteSlashCount: 1,
       }),
-      `JSON.parse(\\'${serialize(escapedEnv).replace(/"/g, '\\\\"')}\\')`,
+      `JSON.parse(\\'${serializedEscapedEnv.replace(/"/g, '\\\\"')}\\')`
     )
     .replace(
       createScriptPlaceholderRegExp({
         doubleQuoteSlashCount: 1,
         singleQuoteSlashCount: 0,
       }),
-      `JSON.parse('${serialize(escapedEnv).replace(/"/g, '\\"')}')`,
+      `JSON.parse('${serializedEscapedEnv.replace(/"/g, '\\"')}')`
     )
     .replace(
       createScriptPlaceholderRegExp({
         doubleQuoteSlashCount: 0,
         singleQuoteSlashCount: 0,
       }),
-      `JSON.parse('${serialize(escapedEnv)}')`,
+      `JSON.parse('${serializedEscapedEnv}')`
     );
 };