Escape regex replacement patterns in environment variables (#157)

Fixes: #156

Author: mpkorstanje

CHANGELOG.md

@@ -6,6 +6,9 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
 ## [Unreleased]
+### Fixed
+- [Java] Escape regex replacement patterns in environment variables ([#156](https://github.com/cucumber/ci-environment/issues/156), [#157](https://github.com/cucumber/ci-environment/pull/157))
+
 ### Added
 - [Go] added ci-environment implementation in Go
 

java/src/main/java/io/cucumber/cienvironment/VariableExpression.java

@@ -4,6 +4,8 @@
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
+import static java.util.regex.Matcher.quoteReplacement;
+
 final class VariableExpression {
     private static final Pattern variablePattern = Pattern.compile("\\$\\{(.*?)(?:(?<!\\\\)/(.*)/(.*))?}");
 
@@ -23,7 +25,7 @@ static String evaluate(String expression, Map<String, String> env) {
             }
             String pattern = variableMatcher.group(2);
             if (pattern == null) {
-                variableMatcher.appendReplacement(sb, value);
+                variableMatcher.appendReplacement(sb, quoteReplacement(value));
             } else {
                 Matcher matcher = Pattern.compile(pattern.replace("\\/", "/")).matcher(value);
                 if (!matcher.matches()) {
@@ -34,7 +36,7 @@ static String evaluate(String expression, Map<String, String> env) {
                     String group = matcher.group(i + 1);
                     replacement = replacement.replace("\\" + (i + 1), group);
                 }
-                variableMatcher.appendReplacement(sb, replacement);
+                variableMatcher.appendReplacement(sb, quoteReplacement(replacement));
             }
         }
         variableMatcher.appendTail(sb);

java/src/test/java/io/cucumber/cienvironment/VariableExpressionTest.java

@@ -24,6 +24,14 @@ public void it_gets_a_value_without_replacement() {
         }});
         assertEquals("some_value", result);
     }
+    @Test
+    public void it_escapes_a_value_without_replacement() {
+        String expression = "${SOME_VAR}";
+        String result = evaluate(expression, new HashMap<String, String>() {{
+            put("SOME_VAR", "${SOME_VAR}");
+        }});
+        assertEquals("${SOME_VAR}", result);
+    }
 
     @Test
     public void it_captures_a_group() {
@@ -52,4 +60,13 @@ public void it_evaluates_a_complex_expression() {
         }});
         assertEquals("hello-amazing-beautiful-gorgeous-world", result);
     }
+    @Test
+    public void it_escapes_a_complex_expression() {
+        String expression = "hello-${VAR1}-${VAR2/(.*) (.*)/\\2-\\1}-world";
+        String result = evaluate(expression, new HashMap<String, String>() {{
+            put("VAR1", "${VAR1}");
+            put("VAR2", "${VAR2a} ${VAR2b}");
+        }});
+        assertEquals("hello-${VAR1}-${VAR2b}-${VAR2a}-world", result);
+    }
 }