Skip to content

Conversation

@PatrikValkovic
Copy link
Contributor

Should solve issue #56

I hope everything checks out. I used dotenv.parse in case there is some additional logic and/or validation.
It worked for me on Windows.

cli.js Outdated
Comment on lines 61 to 64
if(typeof argv.v === 'string')
variables.push(validateCmdVariable(argv.v))
else
variables.push(...argv.v.map(validateCmdVariable))
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you follow the code style and put braces around these?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I update PR to reflect code style in project.

cli.js Outdated
else
variables.push(...argv.v.map(validateCmdVariable))
}
var parsed = dotenv.parse(Buffer.from(variables.join('\n')))
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you put this closer to line 78? and maybe name parsedVariables or something? It feels a bit generic

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I renamed the variable, but I didn't want to move it down, as I believe debug option should print the variables. And it should be after line 73 to overwrite variables from env files.

@@ -3,1387 +3,1502 @@


"@babel/code-frame@^7.0.0":
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess it doesn't matter but why did this file change?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I honestly don't know. I guess YARN uses some new format. It add integrity checks there and wrap some keys into ".

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Give me minute I will try to turn it back.

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, when I run yarn locally, it removes the integrity changes again so I think that's best.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are you using yarn1 or yarn2? Maybe that's the issue. I just pushed version where keys are not escaped using ", but the integrity check is still there. Do we want to have it there?

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm using yarn1, but I'll just reset the file before merging. The security problem is something that needs fixing though.

@entropitor
Copy link
Owner

There is a security problem with the current implementation:

node cli.js -v test="$(echo bax; echo foo=bar)" -p test
# outputs bax
node cli.js -v test="$(echo bax; echo foo=bar)" -p foo
# ouputs bar

@PatrikValkovic
Copy link
Contributor Author

I changed validation to use regex, so no special symbol is allowed.

@entropitor entropitor merged commit ddf835e into entropitor:master Oct 30, 2021
@entropitor
Copy link
Owner

See v4.1.0 on npm

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants