Skip to content

[Fix] parse: a backslash inside single quotes must not escape the closing quote - #26

Merged
ljharb merged 1 commit into
ljharb:mainfrom
mahirhir:fix/parse-single-quote-backslash
Jul 7, 2026
Merged

[Fix] parse: a backslash inside single quotes must not escape the closing quote#26
ljharb merged 1 commit into
ljharb:mainfrom
mahirhir:fix/parse-single-quote-backslash

Conversation

@mahirhir

Copy link
Copy Markdown
Contributor

In a POSIX shell a single-quoted string is fully literal: a backslash inside single quotes is just a backslash and never escapes the closing quote. parse's scanner already follows this (rule 1 in the comment in parse.js; the single-quote branch only does out += c), but the chunker regex that splits the input into tokens does not.

The single-quote matcher is:

var DOUBLE_QUOTE = '\'((\\\\\'|[^\'])*?)\'';

The \' alternative lets the regex treat a backslash-then-quote as an escaped quote inside a single-quoted token, so it walks past the real closing quote and keeps consuming the trailing whitespace and the next token. Two single-quoted tokens that end in a backslash get merged into one:

parse("'\\' '\\'")   // returns ["\\ \\"]  (one token); expected ["\\", "\\"]

This also breaks round-tripping through quote. Since #20, quote wraps a backslash in single quotes without escaping it (quote(["\\"]) === "'\\'"), which is correct, but parse cannot read its own output back:

parse(quote(["\\", "\\"]))   // returns ["\\ \\"]; expected ["\\", "\\"]

The fix drops the \' alternative so the single-quote matcher ends at the first closing quote, matching the scanner and POSIX:

var DOUBLE_QUOTE = '\'([^\']*?)\'';

The normal way to place a quote next to single-quoted text, '\'' (close, escaped quote, reopen), is unaffected: parse("'\\'\\''") still returns ["\\'"].

Added three assertions in test/parse.js (the two-token case, the quote/parse round-trip, and the '\'' preservation case). The full suite passes. Reverting only the parse.js change makes the two behavioral assertions fail.

@ljharb
ljharb force-pushed the fix/parse-single-quote-backslash branch from 08e6d0c to 5d460a3 Compare July 7, 2026 01:37
@codecov

codecov Bot commented Jul 7, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.40%. Comparing base (d390f9a) to head (5d460a3).

Additional details and impacted files
@@           Coverage Diff           @@
##             main      #26   +/-   ##
=======================================
  Coverage   99.40%   99.40%           
=======================================
  Files           3        3           
  Lines         168      168           
  Branches       48       48           
=======================================
  Hits          167      167           
  Misses          1        1           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@ljharb ljharb changed the title [Fix] parse: a backslash inside single quotes must not escape the closing quote [Fix] parse: a backslash inside single quotes must not escape the closing quote Jul 7, 2026
@ljharb ljharb added the bug Something isn't working label Jul 7, 2026
@ljharb
ljharb merged commit 5d460a3 into ljharb:main Jul 7, 2026
671 of 673 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants