* Apply a variable assignment to the scope, handling `+=` append semantics. * SECURITY: If EITHER side (existing value or appended value) contains a * placeholder, the result is non-literal — store VAR_PLACEHOLDER so later * $VAR correctly rejects as bare arg. * `VAR=/etc && VAR+=$(cmd)` must no
(
varScope: Map<string, string>,
ev: { name: string; value: string; isAppend: boolean },
)
| 2015 | * `VAR=/etc && VAR+=$(cmd)` must not leave VAR looking static. |
| 2016 | */ |
| 2017 | function applyVarToScope( |
| 2018 | varScope: Map<string, string>, |
| 2019 | ev: { name: string; value: string; isAppend: boolean }, |
| 2020 | ): void { |
| 2021 | const existing = varScope.get(ev.name) ?? '' |
| 2022 | const combined = ev.isAppend ? existing + ev.value : ev.value |
| 2023 | varScope.set( |
| 2024 | ev.name, |
| 2025 | containsAnyPlaceholder(combined) ? VAR_PLACEHOLDER : combined, |
| 2026 | ) |
| 2027 | } |
| 2028 | |
| 2029 | function stripRawString(text: string): string { |
| 2030 | return text.slice(1, -1) |
no test coverage detected