env-sentinel
Version:
Zero-dependency tool that auto-validates .env files against schema.env, with optional fallback and secure warnings.
51 lines (50 loc) • 1.13 kB
JavaScript
const unsafeEnvKeys = new Set([
'NODE_OPTIONS',
'LD_PRELOAD',
'PYTHONPATH',
'GEM_HOME',
'GEM_PATH',
'PATH',
'HOME',
'SHELL',
'TERM',
'LANG',
'TMPDIR',
'PWD',
'OLDPWD',
'USER',
'LOGNAME',
'DISPLAY',
'XAUTHORITY',
'CI',
'GITHUB_ACTIONS',
'TRAVIS',
'CIRCLECI',
'APPVEYOR',
'GITLAB_CI',
'BUILD_ID',
'RUNNER_NAME',
'CI_COMMIT_SHA',
'DEBUG',
'VERBOSE',
'TEST',
]);
export function noUnsafeKeyCheck(lineNumber, lineContent) {
const equalIndex = lineContent.indexOf('=');
if (equalIndex === -1)
return;
const rawKey = lineContent.slice(0, equalIndex).trim();
const unquotedKey = rawKey.replace(/^['"]|['"]$/g, '');
if (unquotedKey === '')
return;
const upperKey = unquotedKey.toUpperCase();
if (unsafeEnvKeys.has(upperKey)) {
return {
line: lineNumber,
issue: `Variable "${unquotedKey}" is discouraged due to potential security or system conflicts`,
content: lineContent,
severity: 'error',
};
}
return;
}