Sorry, the diff of this file is not supported yet
+1
-1
| { | ||
| "name": "envify", | ||
| "version": "3.1.0", | ||
| "version": "3.2.0", | ||
| "description": "Selectively replace Node-style environment variables with plain strings.", | ||
@@ -5,0 +5,0 @@ "main": "index.js", |
+31
-0
@@ -107,2 +107,33 @@ # envify [](http://travis-ci.org/hughsk/envify) [](http://github.com/hughsk/stability-badges) # | ||
| ## Purging `process.env` ## | ||
| By default, environment variables that are not defined will be left untouched. | ||
| This is because in some cases, you might want to run an envify transform over | ||
| your source more than once, and removing these values would make that | ||
| impossible. | ||
| However, if any references to `process.env` are remaining after transforming | ||
| your source with envify, browserify will automatically insert its shim for | ||
| Node's process object, which will increase the size of your bundle. This weighs | ||
| in at around 2KB, so if you're trying to be conservative with your bundle size | ||
| you can "purge" these remaining variables such that any missing ones are simply | ||
| replaced with undefined. | ||
| To do so through the command-line, simply use the subarg syntax and include | ||
| `purge` after `envify`, e.g.: | ||
| ``` bash | ||
| browserify index.js -t [ envify purge --NODE_ENV development ] | ||
| ``` | ||
| Or if you're using the module API, you can pass `_: "purge"` into your | ||
| arguments like so: | ||
| ``` javascript | ||
| b.transform(envify({ | ||
| _: 'purge' | ||
| , NODE_ENV: 'development' | ||
| })) | ||
| ``` | ||
| ## Contributors ## | ||
@@ -109,0 +140,0 @@ |
+13
-3
@@ -5,2 +5,4 @@ var Syntax = require('jstransform').Syntax | ||
| function create(envs) { | ||
| var args = [].concat(envs[0]._ || []).concat(envs[1]._ || []) | ||
| var purge = args.indexOf('purge') !== -1 | ||
@@ -13,5 +15,3 @@ function visitProcessEnv(traverse, node, path, state) { | ||
| if (value !== undefined) { | ||
| utils.catchup(node.range[0], state) | ||
| utils.append(JSON.stringify(value), state) | ||
| utils.move(node.range[1], state) | ||
| replaceEnv(node, state, value) | ||
| return false | ||
@@ -21,5 +21,15 @@ } | ||
| if (purge) { | ||
| replaceEnv(node, state, undefined) | ||
| } | ||
| return false | ||
| } | ||
| function replaceEnv(node, state, value) { | ||
| utils.catchup(node.range[0], state) | ||
| utils.append(JSON.stringify(value), state) | ||
| utils.move(node.range[1], state) | ||
| } | ||
| visitProcessEnv.test = function(node, path, state) { | ||
@@ -26,0 +36,0 @@ return ( |
| language: node_js | ||
| node_js: | ||
| - 0.10 | ||
| - 0.11 |
-124
| var envify = require('./custom') | ||
| , test = require('tape') | ||
| , fs = require('fs') | ||
| test('Replaces environment variables', function(t) { | ||
| var buffer = '' | ||
| var stream = envify({ | ||
| LOREM: 'ipsum' | ||
| , HELLO: 'world' | ||
| }) | ||
| stream() | ||
| .on('data', function(d) { buffer += d }) | ||
| .on('end', function() { | ||
| t.notEqual(-1, buffer.indexOf('ipsum')) | ||
| t.notEqual(-1, buffer.indexOf('world')) | ||
| t.end() | ||
| }) | ||
| .end([ | ||
| 'process.env.LOREM' | ||
| , 'process.env.HELLO' | ||
| ].join('\n')) | ||
| }) | ||
| test('Ignores assignments', function(t) { | ||
| var buffer = '' | ||
| var stream = envify({ | ||
| LOREM: 'ipsum' | ||
| , HELLO: 'world' | ||
| , UP: 'down' | ||
| }) | ||
| stream() | ||
| .on('data', function(d) { buffer += d }) | ||
| .on('end', function() { | ||
| t.notEqual(-1, buffer.indexOf('world')) | ||
| t.notEqual(-1, buffer.indexOf('lorem')) | ||
| t.notEqual(-1, buffer.indexOf('process.env["LOREM"]')) | ||
| t.notEqual(-1, buffer.indexOf('process.env["HELLO"]')) | ||
| t.notEqual(-1, buffer.indexOf('down')) | ||
| t.equal(-1, buffer.indexOf('process.env.UP')) | ||
| t.end() | ||
| }) | ||
| .end([ | ||
| 'process.env["LOREM"] += "lorem"' | ||
| , 'process.env["HELLO"] = process.env["HELLO"] || "world"' | ||
| , 'process.env.UP' | ||
| ].join('\n')) | ||
| }) | ||
| test('Doesn\'t ignore assigning to a variable', function(t) { | ||
| var buffer = '' | ||
| var stream = envify({ | ||
| LOREM: 'ipsum' | ||
| , HELLO: 'world' | ||
| }) | ||
| stream() | ||
| .on('data', function(d) { buffer += d }) | ||
| .on('end', function() { | ||
| t.notEqual(-1, buffer.indexOf('foo = "ipsum"')) | ||
| t.notEqual(-1, buffer.indexOf('oof = "ipsum"')) | ||
| t.notEqual(-1, buffer.indexOf('oof.bar = "ipsum"')) | ||
| t.notEqual(-1, buffer.indexOf('bar = "world"')) | ||
| t.notEqual(-1, buffer.indexOf('rab = "world"')) | ||
| t.notEqual(-1, buffer.indexOf('process.env.NOTTHERE')) | ||
| t.notEqual(-1, buffer.indexOf('process.env.UNDEFINED')) | ||
| t.end() | ||
| }) | ||
| .end([ | ||
| 'var foo = process.env.LOREM' | ||
| , 'oof = process.env.LOREM' | ||
| , 'oof.bar = process.env.LOREM' | ||
| , 'var bar = process.env.HELLO || null' | ||
| , 'rab = process.env.HELLO || null' | ||
| , 'a = process.env.UNDEFINED' | ||
| , 'b = process.env.NOTTHERE || null' | ||
| ].join('\n')) | ||
| }) | ||
| test('subarg syntax', function(t) { | ||
| var buffer = '' | ||
| var stream = envify({ | ||
| OVERRIDES: 'development' | ||
| , UNTOUCHED: 'staging' | ||
| }) | ||
| stream(__filename, { | ||
| _: ['bogus', 'arguments'] | ||
| , OVERRIDES: 'production' | ||
| }).on('data', function(d) { buffer += d }) | ||
| .on('end', function() { | ||
| t.notEqual(-1, buffer.indexOf('foo = "production"')) | ||
| t.notEqual(-1, buffer.indexOf('bar = "staging"')) | ||
| t.end() | ||
| }) | ||
| .end([ | ||
| 'var foo = process.env.OVERRIDES' | ||
| , 'var bar = process.env.UNTOUCHED' | ||
| ].join('\n')) | ||
| }) | ||
| test('Handles getter properties', function(t) { | ||
| var env = {} | ||
| var buffer = '' | ||
| var stream = envify(env) | ||
| var counter = 0 | ||
| Object.defineProperty(env, 'DYNAMIC', { | ||
| // please don't actually do this: | ||
| get: function() { return counter++ ? 'really!' : 'dynamic!' } | ||
| }) | ||
| stream().on('data', function(d) { buffer += d }) | ||
| .on('end', function() { | ||
| t.notEqual(-1, buffer.indexOf('foo = "dynamic!"')) | ||
| t.notEqual(-1, buffer.indexOf('bar = "really!"')) | ||
| t.end() | ||
| }) | ||
| .end([ | ||
| 'var foo = process.env.DYNAMIC' | ||
| , 'var bar = process.env.DYNAMIC' | ||
| ].join('\n')) | ||
| }) |
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 1 instance in 1 package
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 9 instances in 1 package
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
Found 1 instance in 1 package
146
26.96%2
-92%7189
-22.57%7
-12.5%69
-60.34%