fix(inject): escape metacharacters in module name string (#897)

* test(inject): should escape apostrophe or backslash in module name

* fix(inject): escape apostrophes and backslashes in module name

* test(inject): disable non-portable test on Windows

Author: lightmare

packages/inject/src/index.js

@@ -133,10 +133,12 @@ export default function inject(options) {
             name === keypath ? name : makeLegalIdentifier(`$inject_${keypath}`);
 
           if (!newImports.has(hash)) {
+            // escape apostrophes and backslashes for use in single-quoted string literal
+            const modName = mod[0].replace(/[''\\]/g, '\\$&');
             if (mod[1] === '*') {
-              newImports.set(hash, `import * as ${importLocalName} from '${mod[0]}';`);
+              newImports.set(hash, `import * as ${importLocalName} from '${modName}';`);
             } else {
-              newImports.set(hash, `import { ${mod[1]} as ${importLocalName} } from '${mod[0]}';`);
+              newImports.set(hash, `import { ${mod[1]} as ${importLocalName} } from '${modName}';`);
             }
           }
 

packages/inject/test/snapshots/test.js.md

@@ -26,6 +26,28 @@ Generated by [AVA](https://avajs.dev).
     });␊
     `
 
+## escapes apostrophes in module name
+
+> Snapshot 1
+
+    `import { default as $ } from 'd\\'oh';␊
+    ␊
+    $(() => {␊
+      console.log('ready');␊
+    });␊
+    `
+
+## escapes backslashes in module name
+
+> Snapshot 1
+
+    `import { default as $ } from 'slash\\\\back';␊
+    ␊
+    $(() => {␊
+      console.log('ready');␊
+    });␊
+    `
+
 ## inserts a named import statement
 
 > Snapshot 1

packages/inject/test/snapshots/test.js.snap

@@ -1,5 +1,6 @@
 const fs = require('fs');
 const path = require('path');
+const os = require('os');
 
 const acorn = require('acorn');
 const test = require('ava');
@@ -34,6 +35,19 @@ test('uses the modules property', (t) => {
   });
 });
 
+test('escapes apostrophes in module name', (t) => {
+  compare(t, 'basic', { $: "d'oh" });
+});
+
+if (os.platform() === 'win32') {
+  // backslash is path separator on Windows,
+  // so it cannot appear within filename
+} else {
+  test('escapes backslashes in module name', (t) => {
+    compare(t, 'basic', { $: 'slash\\back' });
+  });
+}
+
 test('inserts a named import statement', (t) => {
   compare(t, 'named', { Promise: ['es6-promise', 'Promise'] });
 });