From 8faa0502bccce7fe38640463666a6f239967f437 Mon Sep 17 00:00:00 2001 From: TseIan Date: Wed, 11 Nov 2026 15:14:36 +0800 Subject: [PATCH] src: do not read the next line for an empty value When an unquoted value was empty but followed by spaces or tabs, as in `KEY= `, the parser trimmed the newline along with the whitespace and took the next line as the value. Strip only spaces and tabs before checking for an empty value. Fixes: https://github.com/nodejs/node/issues/67400 Assisted-by: Claude Code Signed-off-by: TseIan --- src/node_dotenv.cc | 5 +++++ test/parallel/test-util-parse-env.js | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/src/node_dotenv.cc b/src/node_dotenv.cc index 0c6fa30a41d7..56111d54a8f6 100644 --- a/src/node_dotenv.cc +++ b/src/node_dotenv.cc @@ -194,6 +194,11 @@ void Dotenv::ParseContent(const std::string_view input) { content.remove_prefix(equal_or_newline + 1); key = trim_spaces(key); + // Only strip spaces and tabs here: trim_spaces() also strips '\n', which + // would turn the next line into the value of an empty `KEY= `. + content.remove_prefix( + std::min(content.find_first_not_of(" \t"), content.size())); + // If the value is not present (e.g. KEY=) set it to an empty string if (content.empty() || content.front() == '\n') { store_.insert_or_assign(std::string(key), ""); diff --git a/test/parallel/test-util-parse-env.js b/test/parallel/test-util-parse-env.js index e932a31f683e..e9e67f2999e4 100644 --- a/test/parallel/test-util-parse-env.js +++ b/test/parallel/test-util-parse-env.js @@ -66,6 +66,11 @@ assert.deepStrictEqual(util.parseEnv(''), { __proto__: null }); assert.deepStrictEqual(util.parseEnv('FOO=bar\nFOO=baz\n'), { __proto__: null, FOO: 'baz' }); +// Whitespace after an empty value must not pull in the next line. +// Refs: https://github.com/nodejs/node/issues/67400 +assert.deepStrictEqual(util.parseEnv('A= \nB=b\nC=\t\nD=d\nE= '), + { __proto__: null, A: '', B: 'b', C: '', D: 'd', E: '' }); + // Test for invalid input. assert.throws(() => { for (const value of [null, undefined, {}, []]) {