fix(core): Substitute params in length-descending order to avoid substring collisions

Author: z-Fng

CHANGELOG.md

@@ -27,6 +27,7 @@
 - **uninstall:** Import `url_filename` from `download.ps1` ([#6530](https://github.com/ScoopInstaller/Scoop/issues/6530))
 - **schema:** Add missing `hash.mode` value `github` ([#6533](https://github.com/ScoopInstaller/Scoop/issues/6533))
 - **core:** Skip NO_JUNCTION logic when $app is 'scoop' in `currentdir` function ([#6541](https://github.com/ScoopInstaller/Scoop/issues/6541))
+- **core:** Substitute params in length-descending order to avoid substring collisions ([#6561](https://github.com/ScoopInstaller/Scoop/issues/6561))
 
 ### Code Refactoring
 

lib/core.ps1

@@ -1209,12 +1209,15 @@ function substitute($entity, [Hashtable] $params, [Bool]$regexEscape = $false) {
         $newentity = $entity.PSObject.Copy()
         switch ($entity.GetType().Name) {
             'String' {
-                $params.GetEnumerator() | ForEach-Object {
-                    if ($regexEscape -eq $false -or $null -eq $_.Value) {
-                        $newentity = $newentity.Replace($_.Name, $_.Value)
-                    } else {
-                        $newentity = $newentity.Replace($_.Name, [Regex]::Escape($_.Value))
+                $params.Keys | Sort-Object @{Expression = { $_.Length }; Descending = $true }, @{Expression = { $_ }; Descending = $false } | ForEach-Object {
+                    $key = $_
+                    $value = $params[$key]
+
+                    if ($regexEscape -and ($null -ne $value)) {
+                        $value = [Regex]::Escape($value)
                     }
+
+                    $newEntity = $newEntity.Replace($key, $value)
                 }
             }
             'Object[]' {

test/Scoop-Core.Tests.ps1

@@ -393,3 +393,18 @@ Describe 'Format Architecture String' -Tag 'Scoop' {
         { Format-ArchitectureString 'PPC' } | Should -Throw "Invalid architecture: 'ppc'"
     }
 }
+
+Describe 'substitute' -Tag 'Scoop' {
+    It 'should properly handle keys that are substrings of other keys' {
+        $params = @{
+            '$url'           = 'https://example.com/download/win-desktop.exe'
+            '$urlNoExt'      = 'https://example.com/download/win-desktop'
+            '$basename'      = 'win-desktop.exe'
+            '$basenameNoExt' = 'win-desktop'
+            '$NULL'          = $null
+        }
+        substitute '$urlNoExt.sha256' $params $false | Should -Be 'https://example.com/download/win-desktop.sha256'
+        substitute '$basenameNoExt.sha256' $params $false | Should -Be 'win-desktop.sha256'
+        substitute '$NULL.sha256' $params $false | Should -Be '.sha256'
+    }
+}