fix for security issue with windows drive letter regex

ljharb · Oct 21, 2021 · 5799416 · 5799416
1 parent c7de931
commit 5799416
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/index.js b/index.js
@@ -10,7 +10,7 @@ exports.quote = function (xs) {
             return '"' + s.replace(/(["\\$`!])/g, '\\$1') + '"';
         }
         else {
-            return String(s).replace(/([A-z]:)?([#!"$&'()*,:;<=>?@\[\\\]^`{|}])/g, '$1\\$2');
+            return String(s).replace(/([A-Za-z]:)?([#!"$&'()*,:;<=>?@\[\\\]^`{|}])/g, '$1\\$2');
         }
     }).join(' ');
 };

diff --git a/test/quote.js b/test/quote.js
@@ -40,3 +40,9 @@ test('quote windows paths', { skip: 'breaking change, disabled until 2.x' }, fun
 
     t.end()
 })
+
+test("chars for windows paths don't break out", function (t) {
+    var x = '`:\\a\\b'
+    t.equal(quote([x]), '\\`\\:\\\\a\\\\b')
+    t.end()
+})