From fe44978f6e9ca4b84a268bd82c94948d6e4782dd Mon Sep 17 00:00:00 2001
From: MayaTheShy <MayaTheShy@gmail.com>
Date: Fri, 20 Feb 2026 02:48:00 -0500
Subject: [PATCH] style: Escape quotes and backslashes in turtle place methods
 and connectToInventory for safe Lua string interpolation

---
 server/Turtle.js | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/server/Turtle.js b/server/Turtle.js
index ed352d3..a83a833 100644
--- a/server/Turtle.js
+++ b/server/Turtle.js
@@ -588,7 +588,7 @@ export class Turtle extends EventEmitter {
    * Place block in front
    */
   async place(text) {
-    const cmd = text ? `return turtle.place("${text}")` : 'return turtle.place()';
+    const cmd = text ? `return turtle.place("${text.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}")` : 'return turtle.place()';
     const result = await this.exec(cmd);
     if (result === true || (Array.isArray(result) && result[0] === true)) {
       await this.inspect(); // Auto-inspect to update world map
@@ -600,7 +600,7 @@ export class Turtle extends EventEmitter {
    * Place block above
    */
   async placeUp(text) {
-    const cmd = text ? `return turtle.placeUp("${text}")` : 'return turtle.placeUp()';
+    const cmd = text ? `return turtle.placeUp("${text.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}")` : 'return turtle.placeUp()';
     const result = await this.exec(cmd);
     if (result === true || (Array.isArray(result) && result[0] === true)) {
       await this.inspectUp();
@@ -612,7 +612,7 @@ export class Turtle extends EventEmitter {
    * Place block below
    */
   async placeDown(text) {
-    const cmd = text ? `return turtle.placeDown("${text}")` : 'return turtle.placeDown()';
+    const cmd = text ? `return turtle.placeDown("${text.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}")` : 'return turtle.placeDown()';
     const result = await this.exec(cmd);
     if (result === true || (Array.isArray(result) && result[0] === true)) {
       await this.inspectDown();
@@ -758,9 +758,10 @@ export class Turtle extends EventEmitter {
    * Connect to an adjacent inventory peripheral and read its contents
    */
   async connectToInventory(side) {
+    const safeSide = side.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
     const result = await this.exec(`
-      local size = peripheral.call("${side}", "size")
-      local content = peripheral.call("${side}", "list")
+      local size = peripheral.call("${safeSide}", "size")
+      local content = peripheral.call("${safeSide}", "list")
       if next(content) == nil then content = nil end
       return {size = size, content = content}
     `);