From d9fd78a0484d56ad8b2195c3174ae2cf584d7b2f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Arno=C5=A1t=20Dudek?=
 <44229208+dudekaa@users.noreply.github.com>
Date: Fri, 15 Jul 2022 23:04:12 +0200
Subject: [PATCH] fix: shell special characters escaping (#108)

ISSUES CLOSED: #107
---
 __tests__/build-commit.test.js |  7 +++++++
 lib/build-commit.js            | 18 +++++++++---------
 2 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/__tests__/build-commit.test.js b/__tests__/build-commit.test.js
index 72aaea3..876ff2d 100644
--- a/__tests__/build-commit.test.js
+++ b/__tests__/build-commit.test.js
@@ -98,4 +98,11 @@ line 2`;
       expect(buildCommit(answersNoScope, options)).toEqual(expecteMessage);
     });
   });
+
+  it('should escape harmful characters', () => {
+    const altAnswers = { ...answers, subject: 'th"is i\'s a n`ew $ f<ea>ture &' };
+
+    // eslint-disable-next-line prettier/prettier, no-useless-escape
+    expect(buildCommit(altAnswers, {})).toEqual('feat(app): th\\\"is i\'s a n\\`ew \\\\$ f\\<ea\\>ture \\&');
+  });
 });
diff --git a/lib/build-commit.js b/lib/build-commit.js
index a82cd70..84650f4 100644
--- a/lib/build-commit.js
+++ b/lib/build-commit.js
@@ -48,17 +48,17 @@ const addFooter = (footer, config) => {
   return `\n\n${footerPrefix} ${addBreaklinesIfNeeded(footer, config.breaklineChar)}`;
 };
 
-const escapeSpecialChars = result => {
-  // eslint-disable-next-line no-useless-escape
-  const specialChars = ['`'];
-
+const escapeSpecialChars = (result) => {
+  // eslint-disable-next-line no-useless-escape, prettier/prettier
+  const specialChars = ['`', '"', '\\$', '!', '<', '>', '&'];
   let newResult = result;
-  // eslint-disable-next-line array-callback-return
-  specialChars.map(item => {
-    // If user types "feat: `string`", the commit preview should show "feat: `\string\`".
-    // Don't worry. The git log will be "feat: `string`"
-    newResult = result.replace(new RegExp(item, 'g'), '\\`');
+
+  specialChars.forEach((item) => {
+    // If user types `feat: "string"`, the commit preview should show `feat: \"string\"`.
+    // Don't worry. The git log will be `feat: "string"`
+    newResult = newResult.replace(new RegExp(item, 'g'), `\\${item}`);
   });
+
   return newResult;
 };