@jondotsoy/envs 0.1.9-alpha.0 → 0.1.9-alpha.2

package/SECURITY.md

@@ -27,7 +27,7 @@ I will reply as soon as possible and we will coordinate the fix and the disclosu
 | --- | --- | --- |
 | `envs init` | — | Creates `<root>/.envs/`, `<root>/.envs/.gitignore` and `<root>/.envs/values.yml`, only if they do not exist. Never overwrites. |
 | `envs pull` | `<worktree>/.env` of each worktree | Rewrites `<root>/.envs/values.yml`. The file is serialized again, so YAML comments are lost. |
-| `envs push` | `<root>/.envs/values.yml` | Creates or updates `<worktree>/.env` of each worktree that has values. Updates existing variables in place, appends new ones at the end and keeps the rest of the file, except the orphan variables: those `envs` manages (they are or were in `values.yml` or its history) that the worktree no longer resolves are removed. If there are `defaults`, this includes all worktrees. |
+| `envs push` | `<root>/.envs/values.yml` | Creates or updates `<worktree>/.env` of each worktree that has values. Updates existing variables in place, appends new ones at the end and keeps the rest of the file (it sets the mode of every `.env` it writes to `600`, so another user, such as a container mounting it, can no longer read it), except the orphan variables: those `envs` manages (they are or were in `values.yml` or its history) that the worktree no longer resolves are removed. If there are `defaults`, this includes all worktrees. |
 | `envs edit` | Same as `pull` and `push` | Same as `pull` and `push`. It also runs `code -w <root>/.envs/values.yml`. With `--ui` it serves the web editor instead (see below). |
 | `envs use`, `envs restore` | `<root>/.envs/values.yml`, `<root>/.envs/history.ndjson` | Rewrite `values.yml` and then act as `push`. |
 | `envs config` | `<root>/.envs/config.yml` | Creates or updates `<root>/.envs/config.yml` (mode `600`). |
@@ -62,7 +62,7 @@ The server listens on `127.0.0.1` only and exposes the values of every `.env`, s
 `envs push` prints one line for each variable whose value changes, in the form `↻ NAME=VALUE → branch, ...`, and `envs pull` prints `↓ pulling branch, ... - N variables`. To keep secrets out of the terminal and CI logs:
 
 - The value is replaced by `********` when the variable name contains a sensitive word: `SECRET`, `PASSWORD`, `PASSWD`, `PWD`, `TOKEN`, `KEY` (including `API_KEY` and `PRIVATE_KEY`), `CREDENTIAL`, `AUTH`, `SALT` or `SIGNING`. The match is case-insensitive and applies to whole `_`-separated words, so `KEY_FOO` and `AWS_BUCKET_SECRET` are masked but `MONKEY` is not.
-- A URL keeps its host and loses its secrets: `postgres://user:********@host/db?token=********` (the password and the values of sensitive query parameters are masked). A secret stored in a variable with an innocuous name and no URL form is still printed as is.
+- A URL keeps its host and loses its secrets: `postgres://user:********@host/db?token=********` (the password and the values of sensitive query parameters are masked). A value in a well-known secret format (AWS key, GitHub or Slack token, `sk-…` key, private key) is masked whatever the variable is called; any other secret stored in a variable with an innocuous name and no URL form is still printed as is.
 - `envs pull` never prints values, only branch names and the number of variables.
 - `envs lint` messages never include the matched value.
 - Set `NO_COLOR` to a non-empty value to print the output without colors.

package/envs.js

@@ -17,11 +17,18 @@ function dotenvProblem(key, text) {
   if (!/^[\w.-]+$/.test(key)) {
     return "the name is not a valid variable name (only letters, digits, `_`, `.` and `-`)";
   }
+  const needsBackticks = text.includes("'") && (text.includes('"') || /\\[nr]/.test(text));
+  if (needsBackticks && text.includes("`")) {
+    return "the value needs backtick quoting (it has a single quote and a double quote or a literal `\\n`) and also has a backtick, so no .env quoting can hold it as is";
+  }
   if (/[\r\n]/.test(text)) {
     return "the value has a line break, which a .env file cannot hold safely (write it on one line, with `\\n` escapes if the application expects them)";
   }
   return;
 }
+function hasSecretPattern(text) {
+  return SECRET_PATTERNS.some(([pattern]) => pattern.test(text));
+}
 function isSensitiveKey(key) {
   return SENSITIVE_KEY.test(key);
 }
@@ -91,10 +98,10 @@ var init_lint_rules = __esm(() => {
     "xxx"
   ]);
   SECRET_PATTERNS = [
-    [/AKIA[0-9A-Z]{16}/, "an AWS access key id"],
-    [/gh[pousr]_[A-Za-z0-9]{36,}/, "a GitHub token"],
-    [/sk-[A-Za-z0-9_-]{20,}/, "an API secret key"],
-    [/xox[abprs]-[A-Za-z0-9-]{10,}/, "a Slack token"],
+    [/(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}/, "an AWS access key id"],
+    [/(?<![A-Za-z0-9])gh[pousr]_[A-Za-z0-9]{36,}/, "a GitHub token"],
+    [/(?<![A-Za-z0-9])sk-[A-Za-z0-9_-]{20,}/, "an API secret key"],
+    [/(?<![A-Za-z0-9])xox[abprs]-[A-Za-z0-9-]{10,}/, "a Slack token"],
     [/-----BEGIN [A-Z ]*PRIVATE KEY-----/, "a private key"]
   ];
   rules = [
@@ -130,13 +137,10 @@ var init_lint_rules = __esm(() => {
     },
     {
       id: "open-permissions",
-      description: "values.yml or the history is readable by other users.",
-      check: (ctx) => [
-        { file: valuesFile, mode: ctx.valuesMode },
-        ...ctx.hasHistory ? [{ file: historyFile, mode: ctx.historyMode }] : []
-      ].filter(({ mode }) => mode !== undefined && (mode & 63) !== 0).map(({ file, mode }) => ({
-        location: file,
-        message: `${file.slice(".envs/".length)} is readable by other users (mode ${(mode & 511).toString(8)}). Run \`chmod 600 ${file}\`.`
+      description: "values.yml, the history or a worktree's .env is readable by other users.",
+      check: (ctx) => envFiles(ctx).filter(({ mode }) => mode !== undefined && (mode & 63) !== 0).map(({ location, mode }) => ({
+        location,
+        message: `${location.replace(/^\.envs\//, "")} is readable by other users (mode ${(mode & 511).toString(8)}). Run \`chmod 600 ${location}\`.`
       }))
     },
     {
@@ -868,7 +872,7 @@ function parseDotenv(text) {
       continue;
     let value = match[2].trim();
     const quote = value[0];
-    if ((quote === '"' || quote === "'") && value.lastIndexOf(quote) > 0) {
+    if ((quote === '"' || quote === "'" || quote === "`") && value.lastIndexOf(quote) > 0) {
       value = value.slice(1, value.lastIndexOf(quote));
     } else {
       value = value.replace(/\s+#.*$/, "");
@@ -890,9 +894,13 @@ function parseValue(value) {
   return value;
 }
 function formatDotenvValue(value) {
-  if (value !== "" && !/[\s#"'\\$]/.test(value))
+  if (value !== "" && !/[\s#"'`\\$]/.test(value))
     return value;
-  return value.includes('"') ? `'${value}'` : `"${value}"`;
+  if (!value.includes('"') && !/\\[nr]/.test(value))
+    return `"${value}"`;
+  if (!value.includes("'"))
+    return `'${value}'`;
+  return `\`${value}\``;
 }
 function updateDotenv(text, entries, remove = new Set) {
   const pending = new Map(Object.entries(entries));
@@ -1142,7 +1150,9 @@ async function pushLocked(ctx, only) {
     }
     for (const key of orphans)
       removals.set(key, [...removals.get(key) ?? [], label]);
-    await writeFile(join2(path, ".env"), updateDotenv(current, entries, orphans), { mode: 384 });
+    const dotenvPath = join2(path, ".env");
+    await writeFile(dotenvPath, updateDotenv(current, entries, orphans), { mode: 384 });
+    await chmod(dotenvPath, 384).catch(() => {});
   }
   for (const [line, names] of changes) {
     ctx.log(yellow(`\u21BB ${line} \u2192 ${names.join(", ")}`));
@@ -1544,7 +1554,7 @@ Commands:
   history Manage the history (history redact: remove secrets in clear from an existing history)
   config  Read or change .envs/config.yml (config set <key> <value>, config get [key], config delete <key>)
   help    Show this help message
-`, colorsDisabled = () => Boolean(process.env.NO_COLOR), MASK = "********", isMaskedKey = (key) => isSensitiveKey(key) || /(^|_)KEY(_|$)/i.test(key), URL_SECRET, hasUrlSecret = (value) => URL_SECRET.test(value) || /^[a-z][a-z0-9+.-]*:\/\//i.test(value) && sensitiveQuery(value), sensitiveQuery = (value) => [...value.matchAll(/[?&]([^=&\s#]+)=([^&\s#]*)/g)].some(([, name]) => isMaskedKey(name.toUpperCase().replace(/[^A-Z0-9]+/g, "_"))), maskUrlSecrets = (value) => value.replace(URL_SECRET, `$1${MASK}$3`).replace(/([?&])([^=&\s#]+)=([^&\s#]*)/g, (all, sep, name) => isMaskedKey(name.toUpperCase().replace(/[^A-Z0-9]+/g, "_")) ? `${sep}${name}=${MASK}` : all), isSecretEntry = (name, value) => isMaskedKey(name) || hasUrlSecret(value), displayValue = (name, value) => isMaskedKey(name) ? MASK : formatDotenvValue(maskUrlSecrets(value)), paint = (code, text) => colorsDisabled() ? text : `\x1B[${code}m${text}\x1B[0m`, green = (text) => paint(32, text), yellow = (text) => paint(33, text), red = (text) => paint(31, text), defaultContext = () => ({
+`, colorsDisabled = () => Boolean(process.env.NO_COLOR), MASK = "********", isMaskedKey = (key) => isSensitiveKey(key) || /(^|_)KEY(_|$)/i.test(key), URL_SECRET, hasUrlSecret = (value) => URL_SECRET.test(value) || /^[a-z][a-z0-9+.-]*:\/\//i.test(value) && sensitiveQuery(value), sensitiveQuery = (value) => [...value.matchAll(/[?&]([^=&\s#]+)=([^&\s#]*)/g)].some(([, name]) => isMaskedKey(name.toUpperCase().replace(/[^A-Z0-9]+/g, "_"))), maskUrlSecrets = (value) => value.replace(URL_SECRET, `$1${MASK}$3`).replace(/([?&])([^=&\s#]+)=([^&\s#]*)/g, (all, sep, name) => isMaskedKey(name.toUpperCase().replace(/[^A-Z0-9]+/g, "_")) ? `${sep}${name}=${MASK}` : all), isSecretEntry = (name, value) => isMaskedKey(name) || hasUrlSecret(value) || hasSecretPattern(value), displayValue = (name, value) => isMaskedKey(name) || hasSecretPattern(value) ? MASK : formatDotenvValue(maskUrlSecrets(value)), paint = (code, text) => colorsDisabled() ? text : `\x1B[${code}m${text}\x1B[0m`, green = (text) => paint(32, text), yellow = (text) => paint(33, text), red = (text) => paint(31, text), defaultContext = () => ({
   cwd: process.cwd(),
   log: (message) => console.log(message),
   error: (message) => console.error(message),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jondotsoy/envs",
-  "version": "0.1.9-alpha.0",
+  "version": "0.1.9-alpha.2",
   "license": "MIT",
   "author": {
     "name": "Jonathan Delgado",