fix: escape multi-line filenames in list-files shell and csv output

Fixes GHSA-7hc6-8hq5-9q2m

__tests__/csv-escape.test.ts

@@ -20,4 +20,12 @@ describe('csvEscape() backslash escapes every character except subset of definit
   test('Double quote should be escaped by another double quote', () => {
     expect(csvEscape('file " with double quote')).toBe('"file "" with double quote"')
   })
+
+  test('filename with LF should be quoted per RFC 4180', () => {
+    expect(csvEscape('a\nb')).toBe('"a\nb"')
+  })
+
+  test('filename with CRLF should be quoted per RFC 4180', () => {
+    expect(csvEscape('a\r\nb')).toBe('"a\r\nb"')
+  })
 })

__tests__/shell-escape.test.ts

@@ -54,4 +54,16 @@ describe('shellEscape() returns human readable filenames with as few escaping ap
   test('filename with single quote and special characters is split and quoted/escaped as needed', () => {
     expect(shellEscape("file'with $quote")).toBe("file\\''with $quote'")
   })
+
+  test('filename with LF should be single-quoted', () => {
+    expect(shellEscape('x\ntouch pwned.md')).toBe("'x\ntouch pwned.md'")
+  })
+
+  test('filename with CRLF should be single-quoted', () => {
+    expect(shellEscape('x\r\ntouch pwned.md')).toBe("'x\r\ntouch pwned.md'")
+  })
+
+  test('filename with CR should be single-quoted', () => {
+    expect(shellEscape('a\rb')).toBe("'a\rb'")
+  })
 })

dist/index.js

@@ -501,7 +501,7 @@ function csvEscape(value) {
     if (value === '')
         return value;
     // Only safe characters
-    if (/^[a-zA-Z0-9._+:@%/-]+$/m.test(value)) {
+    if (/^[a-zA-Z0-9._+:@%/-]+$/.test(value)) {
         return value;
     }
     // https://tools.ietf.org/html/rfc4180
@@ -533,12 +533,12 @@ function shellEscape(value) {
     if (value === '')
         return value;
     // Only safe characters
-    if (/^[a-zA-Z0-9,._+:@%/-]+$/m.test(value)) {
+    if (/^[a-zA-Z0-9,._+:@%/-]+$/.test(value)) {
         return value;
     }
     if (value.includes("'")) {
         // Only safe characters, single quotes and white-spaces
-        if (/^[a-zA-Z0-9,._+:@%/'\s-]+$/m.test(value)) {
+        if (/^[a-zA-Z0-9,._+:@%/'\s-]+$/.test(value)) {
             return `"${value}"`;
         }
         // Split by single quote and apply escaping recursively

src/list-format/csv-escape.ts

@@ -4,7 +4,7 @@ export function csvEscape(value: string): string {
   if (value === '') return value
 
   // Only safe characters
-  if (/^[a-zA-Z0-9._+:@%/-]+$/m.test(value)) {
+  if (/^[a-zA-Z0-9._+:@%/-]+$/.test(value)) {
     return value
   }
 

src/list-format/shell-escape.ts

@@ -9,13 +9,13 @@ export function shellEscape(value: string): string {
   if (value === '') return value
 
   // Only safe characters
-  if (/^[a-zA-Z0-9,._+:@%/-]+$/m.test(value)) {
+  if (/^[a-zA-Z0-9,._+:@%/-]+$/.test(value)) {
     return value
   }
 
   if (value.includes("'")) {
     // Only safe characters, single quotes and white-spaces
-    if (/^[a-zA-Z0-9,._+:@%/'\s-]+$/m.test(value)) {
+    if (/^[a-zA-Z0-9,._+:@%/'\s-]+$/.test(value)) {
       return `"${value}"`
     }