Repository: PowerShell/PowerShell
File: src/System.Management.Automation/engine/CommandCompletion/CompletionHelpers.cs (C#)

Code before:
        }

        private static bool ContainsCharsToCheck(ReadOnlySpan<char> text, bool escape)
            => text.ContainsAny(escape ? s_escapeCharsToCheck : s_defaultCharsToCheck);

        /// <summary>
        /// Quotes and escapes a given completion text based on the specified options.
        /// </summary>
        /// <param name="completionText">
        /// The text to be quoted and potentially escaped.
        /// </param>
        /// <param name="quote">
        /// The quote character to use for enclosing the text. Defaults to a single quote if not provided.
        /// </param>
        /// <param name="escapeSingleQuoteChars">
        /// Indicates whether single quote characters in the text should be escaped. Defaults to <c>true</c>.
        /// </param>
        /// <returns>
        /// The quoted and optionally escaped version of the <paramref name="completionText"/>.
        /// </returns>
        internal static string QuoteCompletionText(
            string completionText,
            string quote,
            bool escapeSingleQuoteChars = true)
        {
            if (!CompletionRequiresQuotes(completionText, false))
            {
                return quote + completionText + quote;
            }

            string quoteInUse = string.IsNullOrEmpty(quote) ? "'" : quote;

            if (escapeSingleQuoteChars && quoteInUse == "'")
            {
                completionText = CodeGeneration.EscapeSingleQuotedStringContent(completionText);
            }

            return quoteInUse + completionText + quoteInUse;
        }
    }
}


Review comment (security):
I wonder if its better using `ContainsCharactersRequiringQuotes`: https://github.com/PowerShell/PowerShell/blob/3d2a3e106ed0e9f5e69e9b981e97f1d20456b6fb/src/System.Management.Automation/engine/CommandCompletion/CompletionCompleters.cs#L5184-L5187

Atleast we can escape all chars  with single quotes instead just `$` and backticks from `CompletionRequiresQuotes`.

Code after:

            bool hasFrontQuoteAndNoBackQuote = 
                (hasFrontSingleQuote || hasFrontDoubleQuote) && !hasBackSingleQuote && !hasBackDoubleQuote;

            if (hasFrontQuoteAndNoBackQuote)
            {
                wordToComplete = wordToComplete.Substring(1);
                return quoteInUse;
            }

            return string.Empty;
        }

        internal static bool CompletionRequiresQuotes(string completion)
        {
            // If the tokenizer sees the completion as more than two tokens, or if there is some error, then
            // some form of quoting is necessary (if it's a variable, we'd need ${}, filenames would need [], etc.)

            Parser.ParseInput(completion, out Token[] tokens, out ParseError[] errors);

            // Expect no errors and 2 tokens (1 is for our completion, the other is eof)
            // Or if the completion is a keyword, we ignore the errors
            bool requireQuote = !(errors.Length == 0 && tokens.Length == 2);
            if ((!requireQuote && tokens[0] is StringToken) ||
                (tokens.Length == 2 && (tokens[0].TokenFlags & TokenFlags.Keyword) != 0))
            {
                requireQuote = ContainsCharsToCheck(tokens[0].Text);
            }

            return requireQuote;
        }

        private static bool ContainsCharsToCheck(ReadOnlySpan<char> text)
            => text.ContainsAny(s_defaultCharsToCheck);

        /// <summary>
        /// Quotes a given completion text.
        /// </summary>
        /// <param name="completionText">
        /// The text to be quoted.
        /// </param>
        /// <param name="quote">
        /// The quote character to use for enclosing the text. Defaults to a single quote if not provided.
        /// </param>
        /// <returns>
        /// The quoted <paramref name="completionText"/>.
        /// </returns>
        internal static string QuoteCompletionText(string completionText, string quote)
        {
            if (!CompletionRequiresQuotes(completionText))
            {