src: safely remove the last line from dotenv

islandryu · ruyadorno · commit d894cb76ffc2 · 2025-01-05T12:57:28.000-05:00
Refs: #55925 PR-URL: #55982 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
diff --git a/src/node_dotenv.cc b/src/node_dotenv.cc
@@ -182,7 +182,10 @@ void Dotenv::ParseContent(const std::string_view input) {
         }
 
         store_.insert_or_assign(std::string(key), multi_line_value);
-        content.remove_prefix(content.find('\n', closing_quote + 1));
+        auto newline = content.find('\n', closing_quote + 1);
+        if (newline != std::string_view::npos) {
+          content.remove_prefix(newline);
+        }
         continue;
       }
     }
@@ -210,7 +213,10 @@ void Dotenv::ParseContent(const std::string_view input) {
         store_.insert_or_assign(std::string(key), value);
         // Select the first newline after the closing quotation mark
         // since there could be newline characters inside the value.
-        content.remove_prefix(content.find('\n', closing_quote + 1));
+        auto newline = content.find('\n', closing_quote + 1);
+        if (newline != std::string_view::npos) {
+          content.remove_prefix(newline);
+        }
       }
     } else {
       // Regular key value pair.
diff --git a/test/fixtures/dotenv/no-final-newline-single-quotes.env b/test/fixtures/dotenv/no-final-newline-single-quotes.env
@@ -0,0 +1 @@
+BASIC='basic'
diff --git a/test/fixtures/dotenv/no-final-newline.env b/test/fixtures/dotenv/no-final-newline.env
@@ -0,0 +1 @@
+BASIC="basic"
diff --git a/test/parallel/test-dotenv-edge-cases.js b/test/parallel/test-dotenv-edge-cases.js
@@ -8,6 +8,8 @@ const fixtures = require('../common/fixtures');
 
 const validEnvFilePath = '../fixtures/dotenv/valid.env';
 const nodeOptionsEnvFilePath = '../fixtures/dotenv/node-options.env';
+const noFinalNewlineEnvFilePath = '../fixtures/dotenv/no-final-newline.env';
+const noFinalNewlineSingleQuotesEnvFilePath = '../fixtures/dotenv/no-final-newline-single-quotes.env';
 
 describe('.env supports edge cases', () => {
   it('supports multiple declarations, including optional ones', async () => {
@@ -148,4 +150,24 @@ describe('.env supports edge cases', () => {
     assert.strictEqual(child.stderr, '');
     assert.strictEqual(child.code, 0);
   });
+
+  it('should handle file without a final newline', async () => {
+    const code = `
+      require('assert').strictEqual(process.env.BASIC, 'basic');
+    `.trim();
+    const child = await common.spawnPromisified(
+      process.execPath,
+      [ `--env-file=${path.resolve(__dirname, noFinalNewlineEnvFilePath)}`, '--eval', code ],
+    );
+
+    const SingleQuotesChild = await common.spawnPromisified(
+      process.execPath,
+      [ `--env-file=${path.resolve(__dirname, noFinalNewlineSingleQuotesEnvFilePath)}`, '--eval', code ],
+    );
+
+    assert.strictEqual(child.stderr, '');
+    assert.strictEqual(child.code, 0);
+    assert.strictEqual(SingleQuotesChild.stderr, '');
+    assert.strictEqual(SingleQuotesChild.code, 0);
+  });
 });
