@dotenvx/dotenvx 1.22.1 → 1.23.0

package/CHANGELOG.md

@@ -2,7 +2,19 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-## [Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.22.1...main)
+## [Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.23.0...main)
+
+## 1.23.0
+
+### Added
+
+* deeper variable expansion support and protection against self-referencing variables 🛡️ ([#439](https://github.com/dotenvx/dotenvx/pull/439))
+
+## 1.22.2
+
+### Changed
+
+* more lenient handling of `--` separator and better error messaging when flags are ambiguous ([#438](https://github.com/dotenvx/dotenvx/pull/438))
 
 ## 1.22.1
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.22.1",
+  "version": "1.23.0",
   "name": "@dotenvx/dotenvx",
   "description": "a better dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/cli/actions/run.js

@@ -13,6 +13,19 @@ async function run () {
   const options = this.opts()
   logger.debug(`options: ${JSON.stringify(options)}`)
 
+  if (commandArgs.length < 1) {
+    const hasSeparator = process.argv.indexOf('--') !== -1
+
+    if (hasSeparator) {
+      console.error('missing command after [dotenvx run --]. try [dotenvx run -- yourcommand]')
+    } else {
+      const realExample = options.envFile[0] || '.env'
+      console.error(`ambiguous command due to missing '--' separator. try [dotenvx run -f ${realExample} -- yourcommand]`)
+    }
+
+    process.exit(1)
+  }
+
   try {
     let envs = []
     // handle shorthand conventions - like --convention=nextjs
@@ -106,17 +119,7 @@ async function run () {
     }
   }
 
-  // Extract command and arguments after '--'
-  const commandIndex = process.argv.indexOf('--')
-  if (commandIndex === -1 || commandIndex === process.argv.length - 1) {
-    logger.error('missing command after [dotenvx run --]')
-    logger.error('')
-    logger.error('  get help: [dotenvx help run]')
-    logger.error('  or try:   [dotenvx run -- npm run dev]')
-    process.exit(1)
-  } else {
-    await executeCommand(commandArgs, process.env)
-  }
+  await executeCommand(commandArgs, process.env)
 }
 
 module.exports = run

package/src/cli/examples.js

@@ -15,7 +15,7 @@ Try it:
   $ echo "HELLO=World" > .env
   $ echo "console.log('Hello ' + process.env.HELLO)" > index.js
 
-  $ dotenvx run -- node index.js
+  $ dotenvx run -f .env -- node index.js
   [dotenvx] injecting env (1) from .env
   Hello World
   \`\`\`

package/src/lib/helpers/dotenvExpand.js

@@ -1,44 +1,39 @@
-// * /
-// *   (\\)?            # is it escaped with a backslash?
-// *   (\$)             # literal $
-// *   (?!\()           # shouldnt be followed by parenthesis
-// *   (\{?)            # first brace wrap opening
-// *   ([\w.]+)         # key
-// *   (?::-((?:\$\{(?:\$\{(?:\$\{[^}]*\}|[^}])*}|[^}])*}|[^}])+))? # optional default nested 3 times
-// *   (\}?)            # last brace warp closing
-// * /xi
-
-const DOTENV_SUBSTITUTION_REGEX = /(\\)?(\$)(?!\()(\{?)([\w.]+)(?::?-((?:\$\{(?:\$\{(?:\$\{[^}]*\}|[^}])*}|[^}])*}|[^}])+))?(\}?)/gi
-
 function _resolveEscapeSequences (value) {
   return value.replace(/\\\$/g, '$')
 }
 
-function interpolate (value, lookups) {
-  return value.replace(DOTENV_SUBSTITUTION_REGEX, (match, escaped, dollarSign, openBrace, key, defaultValue, closeBrace) => {
-    if (escaped === '\\') {
-      return match.slice(1)
-    } else {
-      if (lookups[key]) {
-        // avoid recursion from EXPAND_SELF=$EXPAND_SELF
-        if (lookups[key] === value) {
-          return lookups[key]
-        } else {
-          return interpolate(lookups[key], lookups)
-        }
-      }
+function interpolate (value, env) {
+  const regex = /(?<!\\)\${([^{}]+)}|(?<!\\)\$([A-Za-z_][A-Za-z0-9_]*)/g
 
-      if (defaultValue) {
-        if (defaultValue.startsWith('$')) {
-          return interpolate(defaultValue, lookups)
-        } else {
-          return defaultValue
-        }
-      }
+  let result = value
+  let match
+  const seen = new Set() // self-referential checker
+
+  while ((match = regex.exec(result)) !== null) {
+    seen.add(result)
+
+    const [template, bracedExpression, unbracedExpression] = match
+    const expression = bracedExpression || unbracedExpression
+    const r = expression.split(/:-|-/)
+    const key = r.shift()
+    const defaultValue = r.join('-')
+    const value = env[key]
 
-      return ''
+    if (value) {
+      // self-referential check
+      if (seen.has(value)) {
+        result = result.replace(template, defaultValue)
+      } else {
+        result = result.replace(template, value)
+      }
+    } else {
+      result = result.replace(template, defaultValue)
     }
-  })
+
+    regex.lastIndex = 0 // reset regex search position to re-evaluate after each replacement
+  }
+
+  return result
 }
 
 function expand (options) {