fix(codersdk): reject trailing data after closing single quote in env import (#27474)

codersdk/usersecretsimport.go

@@ -191,11 +191,7 @@ func parseEnvValue(rhs string, lineNum int) (string, error) {
 		}
 		return unescapeDoubleQuoted(inner), nil
 	case '\'':
-		inner, ok := quotedInner(v, '\'')
-		if !ok {
-			return "", xerrors.Errorf("line %d: missing closing single quote", lineNum)
-		}
-		return inner, nil
+		return singleQuotedInner(v, lineNum)
 	default:
 		return strings.TrimSpace(v), nil
 	}
@@ -222,12 +218,21 @@ func hasOddBackslashRun(s string, before int) bool {
 	return count%2 == 1
 }
 
-func quotedInner(v string, quote byte) (string, bool) {
-	trimmed := strings.TrimRight(v, " \t")
-	if len(trimmed) < 2 || trimmed[len(trimmed)-1] != quote {
-		return "", false
+// singleQuotedInner returns the content between the opening single
+// quote at index 0 and the first closing single quote. Single quotes
+// have no escape sequences, so the first quote after the opener always
+// closes the value. Only whitespace may follow the closing quote.
+func singleQuotedInner(v string, lineNum int) (string, error) {
+	for i := 1; i < len(v); i++ {
+		if v[i] != '\'' {
+			continue
+		}
+		if strings.Trim(v[i+1:], " \t") != "" {
+			return "", xerrors.Errorf("line %d: unexpected data after closing single quote", lineNum)
+		}
+		return v[1:i], nil
 	}
-	return trimmed[1 : len(trimmed)-1], true
+	return "", xerrors.Errorf("line %d: missing closing single quote", lineNum)
 }
 
 func unescapeDoubleQuoted(s string) string {