Updated regex and excluded certain characters

j92 · j92 · commit d2228e8118d4 · 2019-07-10T19:59:53.000+02:00
diff --git a/src/Symfony/Component/Dotenv/.env b/src/Symfony/Component/Dotenv/.env
@@ -0,0 +1 @@
+FOOBAR=${BAR:=production}
diff --git a/src/Symfony/Component/Dotenv/Dotenv.php b/src/Symfony/Component/Dotenv/Dotenv.php
@@ -427,7 +427,7 @@ private function resolveVariables($value)
             (?!\()                                # no opening parenthesis
             (?P<opening_brace>\{)?                # optional brace
             (?P<name>'.self::VARNAME_REGEX.')?    # var name
-            (?P<default_value>(?:(:-)([^\}]+)))?  # optional default value
+            (?P<default_value>:-[^\}]+)?          # optional default value
             (?P<closing_brace>\})?                # optional closing brace
         /x';
 
@@ -458,6 +458,10 @@ private function resolveVariables($value)
             }
 
             if ('' === $value && isset($matches['default_value'])) {
+                if (strpbrk($matches['default_value'], '\'"{}$')) {
+                    throw $this->createFormatException('Invalid character in default value');
+                }
+
                 $value = substr($matches['default_value'], 2);
             }
 
diff --git a/src/Symfony/Component/Dotenv/Tests/DotenvTest.php b/src/Symfony/Component/Dotenv/Tests/DotenvTest.php
@@ -48,6 +48,9 @@ public function getEnvDataWithFormatErrors()
             ['FOO!', "Missing = in the environment variable declaration in \".env\" at line 1.\n...FOO!...\n     ^ line 1 offset 3"],
             ['FOO=$(echo foo', "Missing closing parenthesis. in \".env\" at line 1.\n...FOO=$(echo foo...\n                ^ line 1 offset 14"],
             ['FOO=$(echo foo'."\n", "Missing closing parenthesis. in \".env\" at line 1.\n...FOO=$(echo foo\\n...\n                ^ line 1 offset 14"],
+            ["FOO=\nBAR=\${FOO:-\'a{a}a}", "Invalid character in default value in \".env\" at line 2.\n...\\nBAR=\${FOO:-\'a{a}a}...\n                       ^ line 2 offset 24"],
+            ["FOO=\nBAR=\${FOO:-a\$a}", "Invalid character in default value in \".env\" at line 2.\n...FOO=\\nBAR=\${FOO:-a\$a}...\n                       ^ line 2 offset 20"],
+            ["FOO=\nBAR=\${FOO:-a\"a}", "Unclosed braces on variable expansion in \".env\" at line 2.\n...FOO=\\nBAR=\${FOO:-a\"a}...\n                    ^ line 2 offset 17"],
         ];
 
         if ('\\' !== \DIRECTORY_SEPARATOR) {
