linux/ohmyzsh
1
0
Fork 0
mirror of https://github.com/ohmyzsh/ohmyzsh.git synced 2026-05-29 04:53:17 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(dotenv): introduce safe parsing of .env files (#13778)
Some checks failed
Scorecard supply-chain security / Scorecard analysis (push) Has been cancelled
Details

Browse source 
* fix(dotenv): expect explicit yes before loading .env file
* fix(dotenv): implement secure parsing for .env files and add comprehensive tests
* feat(dotenv): check for .env file size to prevent DoS
* fix(dotenv): forbid setting special variables
* fix(dotenv): FIFO shouldn't be read twice
* fix(dotenv): unknown vars should expand to empty
* fix(dotenv): reject extremely large named pipes
* docs(dotenv): update to new parsing system
* fix(dotenv): add support for escaped dollars
* chore(dotenv): only declare local variables once
* fix(dotenv): apply review suggestions
* docs(dotenv): update test instructions

Co-authored-by: Carlo Sala <carlosalag@protonmail.com>
This commit is contained in:
Marc Cornellà 2026-05-28 20:23:45 +02:00 • committed by GitHub
commit d170d18746
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
10 changed files with 1219 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

23
plugins/dotenv/tests/_support/fixtures/features.env Normal file
View file

@ -0,0 +1,23 @@
# Export syntax
export EXPORTED_VAR=exported_value
export EXPORTED_EMPTY=
# Variable expansion (in-file forward references)
BASE_URL=https://api.example.com
API_ENDPOINT="${BASE_URL}/v1"
FULL_ENDPOINT=$BASE_URL/v2/users
COMBINED="${BASE_URL}_suffix"
# Testing multiline quoting edge cases
MULTILINE_UNQUOTED=This\ is\ a\ \
multiline\ value\ that\ should\ be\ treated\ as\ a\ single\ line\ with\ a\ literal\ backslash\ and\ newline
MULTILINE_DOUBLE_QUOTED="This is a \
multiline value that should be treated as a single line with an actual newline character"
MULTILINE_SINGLE_QUOTED='This is a \
multiline value that should be treated as a single line with a literal backslash and newline'
MULTILINE_MIXED_QUOTES="This is a \
multiline value that should be treated as a single line with an actual newline character and a literal backslash \"and 'single quotes' inside"
# Test for regressions
DATABASE_URL="postgres://user:pass@host/db;sslmode=require"
VAR_WITH_SEMICOLONS="value ; with ; semicolons"