src: safely remove the last line from dotenv

islandryu · marco-ippolito · commit 8af1b53bb829 · 2025-03-06T13:38:02.000+01:00
Refs: #55925 PR-URL: #55982 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
diff --git a/src/node_dotenv.cc b/src/node_dotenv.cc
@@ -197,7 +197,10 @@ void Dotenv::ParseContent(const std::string_view input) {
         }
 
         store_.insert_or_assign(std::string(key), multi_line_value);
-        content.remove_prefix(content.find('\n', closing_quote + 1));
+        auto newline = content.find('\n', closing_quote + 1);
+        if (newline != std::string_view::npos) {
+          content.remove_prefix(newline);
+        }
         continue;
       }
     }
@@ -225,7 +228,10 @@ void Dotenv::ParseContent(const std::string_view input) {
         store_.insert_or_assign(std::string(key), value);
         // Select the first newline after the closing quotation mark
         // since there could be newline characters inside the value.
-        content.remove_prefix(content.find('\n', closing_quote + 1));
+        auto newline = content.find('\n', closing_quote + 1);
+        if (newline != std::string_view::npos) {
+          content.remove_prefix(newline);
+        }
       }
     } else {
       // Regular key value pair.
diff --git a/test/fixtures/dotenv/no-final-newline-single-quotes.env b/test/fixtures/dotenv/no-final-newline-single-quotes.env
@@ -0,0 +1 @@
+BASIC='basic'
diff --git a/test/fixtures/dotenv/no-final-newline.env b/test/fixtures/dotenv/no-final-newline.env
@@ -0,0 +1 @@
+BASIC="basic"
diff --git a/test/parallel/test-dotenv-edge-cases.js b/test/parallel/test-dotenv-edge-cases.js
@@ -8,6 +8,8 @@ const fixtures = require('../common/fixtures');
 
 const validEnvFilePath = '../fixtures/dotenv/valid.env';
 const nodeOptionsEnvFilePath = '../fixtures/dotenv/node-options.env';
+const noFinalNewlineEnvFilePath = '../fixtures/dotenv/no-final-newline.env';
+const noFinalNewlineSingleQuotesEnvFilePath = '../fixtures/dotenv/no-final-newline-single-quotes.env';
 
 describe('.env supports edge cases', () => {
   it('supports multiple declarations, including optional ones', async () => {
@@ -148,4 +150,24 @@ describe('.env supports edge cases', () => {
     assert.strictEqual(child.stderr, '');
     assert.strictEqual(child.code, 0);
   });
+
+  it('should handle file without a final newline', async () => {
+    const code = `
+      require('assert').strictEqual(process.env.BASIC, 'basic');
+    `.trim();
+    const child = await common.spawnPromisified(
+      process.execPath,
+      [ `--env-file=${path.resolve(__dirname, noFinalNewlineEnvFilePath)}`, '--eval', code ],
+    );
+
+    const SingleQuotesChild = await common.spawnPromisified(
+      process.execPath,
+      [ `--env-file=${path.resolve(__dirname, noFinalNewlineSingleQuotesEnvFilePath)}`, '--eval', code ],
+    );
+
+    assert.strictEqual(child.stderr, '');
+    assert.strictEqual(child.code, 0);
+    assert.strictEqual(SingleQuotesChild.stderr, '');
+    assert.strictEqual(SingleQuotesChild.code, 0);
+  });
 });

Original file line number	Diff line number	Diff line change
`@@ -197,7 +197,10 @@ void Dotenv::ParseContent(const std::string_view input) {`
`197`	`197`	`}`
`198`	`198`
`199`	`199`	`store_.insert_or_assign(std::string(key), multi_line_value);`
`200`		`- content.remove_prefix(content.find('\n', closing_quote + 1));`
	`200`	`+ auto newline = content.find('\n', closing_quote + 1);`
	`201`	`+ if (newline != std::string_view::npos) {`
	`202`	`+ content.remove_prefix(newline);`
	`203`	`+ }`
`201`	`204`	`continue;`
`202`	`205`	`}`
`203`	`206`	`}`
`@@ -225,7 +228,10 @@ void Dotenv::ParseContent(const std::string_view input) {`
`225`	`228`	`store_.insert_or_assign(std::string(key), value);`
`226`	`229`	`// Select the first newline after the closing quotation mark`
`227`	`230`	`// since there could be newline characters inside the value.`
`228`		`- content.remove_prefix(content.find('\n', closing_quote + 1));`
	`231`	`+ auto newline = content.find('\n', closing_quote + 1);`
	`232`	`+ if (newline != std::string_view::npos) {`
	`233`	`+ content.remove_prefix(newline);`
	`234`	`+ }`
`229`	`235`	`}`
`230`	`236`	`} else {`
`231`	`237`	`// Regular key value pair.`