@dotenvx/dotenvx 1.24.0 → 1.24.2

package/CHANGELOG.md

@@ -2,7 +2,19 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-## [Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.24.0...main)
+## [Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.24.2...main)
+
+## 1.24.2
+
+### Changed
+
+* treat pre-existing expandable values as literal in `process.env` ([#450](https://github.com/dotenvx/dotenvx/pull/450))
+
+## 1.24.1
+
+### Changed
+
+* bump `cross-spawn` to prevent potential ReDoS [CVE-2024-21538](https://github.com/advisories/ghsa-3xgq-45jj-v275) ([#449](https://github.com/dotenvx/dotenvx/pull/449))
 
 ## 1.24.0
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.24.0",
+  "version": "1.24.2",
   "name": "@dotenvx/dotenvx",
   "description": "a better dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/lib/helpers/parse.js

@@ -49,7 +49,7 @@ class Parse {
       }
 
       // expand empty, double, or backticks
-      if (quote !== "'") {
+      if (quote !== "'" && !this.processEnv[key]) {
         this.parsed[key] = resolveEscapeSequences(this.expand(this.parsed[key]))
       }
 
@@ -141,11 +141,8 @@ class Parse {
 
     let result = value
     let match
-    const seen = new Set() // self-referential checker
 
     while ((match = regex.exec(result)) !== null) {
-      seen.add(result)
-
       const [template, bracedExpression, unbracedExpression] = match
       const expression = bracedExpression || unbracedExpression
 
@@ -157,31 +154,30 @@ class Parse {
 
       const r = expression.split(splitter)
 
-      let key
       let defaultValue
       let value
 
+      const key = r.shift()
+
       if ([':+', '+'].includes(splitter)) {
-        key = r.shift()
         defaultValue = env[key] ? r.join(splitter) : ''
         value = null
       } else {
-        key = r.shift()
         defaultValue = r.join(splitter)
         value = env[key]
       }
 
       if (value) {
-        // self-referential check
-        if (seen.has(value)) {
-          result = result.replace(template, defaultValue)
-        } else {
-          result = result.replace(template, value)
-        }
+        result = result.replace(template, value)
       } else {
         result = result.replace(template, defaultValue)
       }
 
+      // if the result equaled what was in env then stop expanding - handle self-referential check as well
+      if (result === env[key]) {
+        break
+      }
+
       regex.lastIndex = 0 // reset regex search position to re-evaluate after each replacement
     }