Command substitution improperly expands double-quotes

[mrj]

Parsing the file

x='"a"'
y="$(echo "$x")"

gives

{"x" => "\"a\"", "y" => "a"}

when the real Bash gives the same for echo $x and echo $y.

Because of this, Json objects can only be used in parsed commands by backslashing every double quote.

[i7an]

This particular case should be relatively easy to fix with:

# lib/dotenv/substitutions/variable.rb:28
(env[match[3]] || ENV[match[3]] || "").gsub('"', "\\\"")

But I'm not sure what other characters should be escaped as well (maybe there is a helper method somewhere 🤔 ). I will try to look later if I have more time.

[mrj]

I've verified that the above fix works for Kamal Rails deploys with unescaped secrets JSON objects. Thank you.

Because Kamal builds these secrets into the Docker containers locally on the dev machine, I was able to make this change by editing the local gem file rather than doing a custom fork.

But just like the other fix for escaping parentheses, implementing this fix will break existing Kamal deployments that rely on extensive escaping of JSON. But I think the Band-Aid needs to be ripped in some way.