fix: reject ${VAR} in rules:if (#1854)

Author: firecow

src/utils.ts

@@ -215,6 +215,7 @@ export class Utils {
 
     static evaluateRuleIf (ruleIf: string | undefined, envs: {[key: string]: string}): boolean {
         if (ruleIf === undefined) return true;
+        assert(!/\$\{\w+\}/.test(ruleIf), chalk`rules:rule if invalid expression syntax: {blueBright ${ruleIf}}\nuse {green $VAR} not {red \${VAR\}} in rules:if`);
         let evalStr = ruleIf;
 
         const flagsToBinary = (flags: string): number => {

tests/rules.test.ts

@@ -85,6 +85,11 @@ test.concurrent("VAR exists positive", () => {
     expect(val).toBe(true);
 });
 
+test.concurrent("rejects ${VAR} curly-bracket reference", () => {
+    expect(() => Utils.evaluateRuleIf("${VAR} == 'true'", {VAR: "true"}))
+        .toThrow(/rules:rule if invalid expression syntax/);
+});
+
 test.concurrent("VAR exists fail", () => {
     const ruleIf = "$VAR";
     const val = Utils.evaluateRuleIf(ruleIf, {});

tests/test-cases/rules-curly-bracket-if/.gitlab-ci.yml

@@ -0,0 +1,6 @@
+---
+job:
+  rules:
+    - if: '${GITLAB_CI} == "true"'
+  script:
+    - echo "should not run"

tests/test-cases/rules-curly-bracket-if/integration.test.ts

@@ -0,0 +1,17 @@
+import {WriteStreamsMock} from "../../../src/write-streams.js";
+import {handler} from "../../../src/handler.js";
+import {initSpawnSpy} from "../../mocks/utils.mock.js";
+import {WhenStatics} from "../../mocks/when-statics.js";
+
+beforeAll(() => {
+    initSpawnSpy(WhenStatics.all);
+});
+
+test.concurrent("rules-curly-bracket-if rejects ${VAR} in rules:if", async () => {
+    const writeStreams = new WriteStreamsMock();
+
+    await expect(handler({
+        cwd: "tests/test-cases/rules-curly-bracket-if",
+        stateDir: ".gitlab-ci-local-rules-curly-bracket-if",
+    }, writeStreams)).rejects.toThrow(/rules:rule if invalid expression syntax/);
+});