fix(core): prevent ${} re-interpretation in getRoutePath and escape single quotes in getRouteAsArray

getRoutePath: after jsesc escapes ${ to \${, the remaining {evil} was
mistaken for an OpenAPI path param and re-converted to ${evil}. Add
early-return when { is preceded by $.

getRouteAsArray: segments wrapped in single-quoted strings without
escaping '. A spec path containing ' would break out. Now escapes
single quotes at both wrap sites.

Author: aqeelat

packages/core/src/getters/route.test.ts

@@ -265,12 +265,35 @@ describe('getRoute — spec path injection', () => {
     expect(result).not.toMatch(/(?<!\\)`/);
   });
 
-  it('neutralizes ${...} that is not a valid path param', () => {
-    // ${globalThis.X} in a path is NOT an OpenAPI path param ({param}).
-    // getRoutePath's regex rejects it (dot in param name), so it stays
-    // as literal text — no live interpolation.
-    const result = getRoute('/v1/${globalThis.X}/path');
-    expect(result).not.toMatch(/(?<!\\)\$\{globalThis/);
+  it('does not re-interpret ${...} as a live interpolation', () => {
+    // ${evil} in a path is NOT an OpenAPI path param ({param}).
+    // jsesc escapes ${ to \${, and getRoutePath must not treat the
+    // remaining {evil} as a param — otherwise it re-creates ${evil}.
+    for (const payload of [
+      '/v1/${evil}/path',
+      '/v1/${globalThis.X}/path',
+      '/v1/{petId}${evil}/path',
+    ]) {
+      const result = getRoute(payload);
+      expect(result).not.toMatch(/(?<!\\)\$\{evil/);
+      expect(result).not.toMatch(/(?<!\\)\$\{globalThis/);
+    }
+  });
+
+  it('still converts legitimate path params', () => {
+    expect(getRoute('/v1/{petId}')).toContain('${petId}');
+  });
+});
+
+describe('getRouteAsArray — single-quote injection', () => {
+  it('escapes single quote in static segment', () => {
+    const result = getRouteAsArray("v1/it's/path");
+    expect(result).toContain("it\\'s");
+  });
+
+  it('escapes single quote in non-interpolation part of mixed segment', () => {
+    const result = getRouteAsArray("pre's${petId}");
+    expect(result).toContain("pre\\'s");
   });
 });
 

packages/core/src/getters/route.ts

@@ -34,6 +34,14 @@ function runtimeExpressionToUrlPrefix(expression: string): string {
 const hasParam = (path: string): boolean => /[^{]*{[\w*_-]*}.*/.test(path);
 
 const getRoutePath = (path: string): string => {
+  // Don't treat ${...} as a path param — OpenAPI params use {param}, not
+  // ${param}. After jsesc boundary escaping, ${ becomes \${, but the { is
+  // still visible to the regex below and would be misinterpreted as a param.
+  const braceIdx = path.indexOf('{');
+  if (braceIdx > 0 && path[braceIdx - 1] === '$') {
+    return path;
+  }
+
   const matches = /([^{]*){?([\w*_-]*)}?(.*)/.exec(path);
   if (!matches?.length) return path; // impossible due to regexp grouping here, but for TS
 
@@ -182,15 +190,15 @@ export function getRouteAsArray(route: string): string {
     .filter((i) => i !== '')
     .flatMap((segment) => {
       if (!segment.includes('${')) {
-        return [`'${segment}'`];
+        return [`'${segment.replaceAll("'", "\\'")}'`];
       }
       // Split by template tags, keeping the delimiters
       return segment
         .split(/(\$\{.+?\})/g)
         .filter(Boolean)
         .map((part) => {
           const match = /^\$\{(.+?)\}$/.exec(part);
-          return match ? match[1] : `'${part}'`;
+          return match ? match[1] : `'${part.replaceAll("'", "\\'")}'`;
         });
     })
     .join(',');