[Fix] parse: match nested ${...} braces so nested parameter expansion is consumed as one substitution

Author: ljharb

parse.js

@@ -150,10 +150,21 @@ function parseInternal(string, env, opts) {
 				if (s.charAt(i) === '}') {
 					throw new Error('Bad substitution: ' + s.slice(i - 2, i + 1));
 				}
-				varend = s.indexOf('}', i);
-				if (varend < 0) {
+				// match braces by depth so a nested `${` keeps its inner `}` from ending the outer substitution
+				var depth = 1;
+				varend = i;
+				while (depth > 0 && varend < s.length) {
+					if (s.charAt(varend) === '{' && s.charAt(varend - 1) === '$') {
+						depth += 1;
+					} else if (s.charAt(varend) === '}') {
+						depth -= 1;
+					}
+					varend += 1;
+				}
+				if (depth !== 0) {
 					throw new Error('Bad substitution: ' + s.slice(i));
 				}
+				varend -= 1;
 				varname = s.slice(i, varend);
 				i = varend;
 			} else if ((/[*@#?$!_-]/).test(char)) {

test/parse.js

@@ -77,6 +77,19 @@ test('unmatched single quotes', function (t) {
 	t.end();
 });
 
+test('nested parameter expansion', function (t) {
+	t.same(parse('${a${b}c}'), [''], 'a nested ${} is consumed as one substitution, not split at the first }');
+	t.same(parse('${a${b}}'), [''], 'a nested ${} at the end is consumed as one substitution');
+	t.same(parse('${foo{bar}'), [''], 'a lone { that is not part of a nested ${} does not change brace depth');
+	t.same(
+		parse('level=${levels[$RANDOM%${#levels[@]}]}'),
+		['level='],
+		'a nested array-index expansion is consumed whole, without leaking a partial token'
+	);
+
+	t.end();
+});
+
 test('parse stays linear in token count (GHSA-395f-4hp3-45gv)', function (t) {
 	// the old concat-in-reduce finalizer was O(n^2): this many tokens took
 	// ~minutes, so under the unfixed code this test hangs rather than passes