You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
HCL synth doesn't escape backslashes in strings: the default local backend path on Windows produces invalid cdk.tf #562
HCL synth escapes backslashes in string literals, so a Windows path renders as "C:\\Users\\...".
Actual Behavior
Backslashes are copied through unchanged. Every HCL synth on Windows that uses the default local backend produces a cdk.tf that won't init. LocalBackend defaults to path.join(process.cwd(), ...) (local-backend.ts:23), which is an absolute backslash path on Windows:
Error: Invalid escape sequence
on cdk.tf line 6, in terraform:
6: path = "C:\Users\me\project\terraform.s.tfstate"
The \U escape sequence must be followed by eight hexadecimal digits.
(Path shortened.) Terraform 1.14.3 and OpenTofu 1.12.6 on Windows 11 both reject it at init. The JSON output for the same stack is valid.
Steps to Reproduce
On Windows, with SYNTH_HCL_OUTPUT=true, synthesize any stack without an explicit backend and run terraform init -backend=false in the stack directory. I reproduced this by running the library directly on upstream/main, not through the CLI.
Any string attribute containing a backslash hits the same bug, not just the backend path. A path ending in \ leaves the string unterminated.
Cause
String literals go through escapeQuotes (render.ts:10-16, used at L46 and L589). That function only escapes ", and it skips any " that follows a backslash.
Possible Solutions
Escape \ before " in literal strings, which is what JSON.stringify does. The (?<!\\) lookbehind would then have to go too, because once backslashes are escaped, a backslash before a quote is no longer a sign that the quote is already escaped. Strings containing ${ take a separate path and need the same treatment inside the literal parts.
Activity