Address values can be interpreted as format tokens

[trishrempel]

Problem

Address values containing Worldwide format tokens can be interpreted as later placeholders because fields are substituted sequentially.

address = Worldwide::Address.new(
  first_name: "{lastName}",
  last_name: "Smith",
  address1: "{phone}",
  country_code: "US",
  phone: "secret",
)

address.format(excluded_fields: [:phone])

Worldwide 1.25.6 formats the recipient as Smith Smith instead of preserving the literal first name {lastName}. It can also expand the literal address value {phone} to the phone data even though the phone field was excluded.

Additional lines are processed through the same substitution path and have the same behavior.

Cause

Address#fill_in_fields substitutes each field in sequence. A replacement value inserted early can contain a token that is matched during a later field substitution.

Using block replacement, as proposed in #533, fixes backslash interpretation but does not prevent a token inserted for one field from being processed during a later field's substitution.

Expected behavior

Address values and additional line values should be treated as literal data. They should not be interpreted as format syntax, and excluded field values should not be reintroduced through user supplied tokens.

This was found while migrating ShopifyI18n::AddressFormatter to delegate directly to Worldwide. The downstream adapter should not need to escape Worldwide's internal format syntax.

[najibna]

Hi! I’d like to work on this. I’ll replace address format tokens in a single pass so user values are treated as literal data, and add tests for {lastName}, {phone}, and excluded fields.