Cloud Functions: Fix env var escaping

[yellcorp]

Description

Fixes #4270 and a little bit more.

The bug results from the use of String.prototype.replace with a first (search) argument of type string. This is an unintuitive corner of JavaScript that only replaces the first occurrence of the search string. See MDN. To replace all occurrences, either the search argument must be expressed as an equivalent regex with the /g flag, or .replaceAll must be used. .replaceAll isn't supported below Node 15, and given this package's dependency on Node >= 12, the regex approach has been used here.

Quick demonstration:

Welcome to Node.js v16.13.2.
Type ".help" for more information.
> const aaaa = "aaaa";
undefined
> aaaa.replace("a", "b") // string argument; replaces only the first occurrence
'baaa'
> aaaa.replace(/a/, "b") // regex argument *without* /g flag; replaces only the first occurrence
'baaa'
> aaaa.replace(/a/g, "b") // regex argument *with* /g flag; replaces all occurrences
'bbbb'
> aaaa.replaceAll("a", "b") // replaceAll method in Node >= 15; replaces all occurrences
'bbbb'

There's another reason to use a regex approach - running the string through repeated invocations of .replace(All) processes the escapes in an implementation-defined order, whereas the string really should be scanned from start to end in order to correctly convert (for example) \\n to \ n. The popular npm package dotenv gets tripped up by this as well.

The changes outside .env files result from manually searching the repo for uses of String.prototype.replace having a non-regex first argument. There are more occurrences than the ones fixed here that probably should be audited, but 1. Not all instances are immediately obvious to me whether they intend to replace all occurrences of the search argument 2. I wanted to keep this PR focused.

Scenarios Tested

User journeys

• User wishes to deploy or emulate Cloud Functions using an .env file in which one or more values contain a quoted value having 2 or more escape sequences.

Edge cases

• Sequences that resemble escaped newlines, but actually aren't. For example \\n should be interpreted as backslash, letter n.

[yellcorp]

Apologies, looks like the entire commit history has been dragged along with this! Investigating…

Fixed!

[yellcorp]

Other String.prototype.replace usage of potential concern:

• src/extensions/export.ts#L18-L19 - Not clear if projectId or projectNumber has the potential to appear more than once. If not, it's ok.
• defaultCredentials.ts#L105 - This will only replace at most one dot with an underscore, so will fail on emails like firstname.lastname@example.com or name@subdomain.example.com. Coincidentally, the log I attached to the original issue shows this problem on line 16. Note that my default creds file is called jim_boswell_byhook.com_application_default_credentials.json - the . before com has not been replaced with _. Fixing this would possibly need to be supported by some migration process. The extra dot doesn't actually cause an issue in practice so may not be worth pursuing.

[taeold]

@yellcorp This is an incredible contribution - I learned so much from your thorough writeup. Thank you so much for your time in reporting, fixing, and educating us about the issue!

It's late in US, so I'll defer reviewing the code to first thing tomorrow morning!

[taeold]

❤️ Incredible work!

[taeold]

+1 on adding backlashes to the list of things we replace!