Security News
PyPI’s New Archival Feature Closes a Major Security Gap
PyPI now allows maintainers to archive projects, improving security and helping users make informed decisions about their dependencies.
The environment is dangerous. Your lawn is nice. Stay in your lawn.
Lawn is a library for validating that your environment variables are what you expect, and generating .env files.
const lawn = require('lawn')
You've gone all in on the Twelve-Factor App and/or you always store your application configuration in environment variables.
Now configuration values are strewn throughout your code, parsed in some places, expected to conform in certain ways in other places.
And then, when a new teammate gets spun up on the project, they have no idea what environment variables they need to set.
Enter, lawn
. Lawn lets you declaratively express all of your configuration
up-front.
// lawn-spec.js
module.exports = {
PORT: lawn.number.desc('The port that the server will listen on').default(8000),
SECRET: lawn.string.desc('The encryption key. Set it very secretly').example('S3CR3T'),
}
// index.js
const lawn = require('lawn')
const lawnSpec = require('./lawn-spec')
const config = lawn.validate(lawnSpec, process.env)
Lawn transforms and validates your properties.
config.port
//=> 8000 (a number, not a string)
If you've ever included an .env.sample in your project, you'll know it gets out-of-date. Instead of maintaining an .env.sample when changing an environment variable, generate it from the config instead.
console.log(lawn.output(lawnSpec))
This outputs
# The port that the server will listen on (defaults to 8000)
# PORT=8000
# The encryption key. Set it very secretly
SECRET=S3CR3T
The root spec object.
Validate the given spec against the properties given. If no properties are
given, process.env
is used.
If the validation succeeds, the transformed configuration will be returned.
If the validation fails, an error will be thrown with a reasonable error message.
const lawnSpec = {
PORT: lawn.number.description('The port to listen on').default(8000),
DEBUG: lawn.bool.description('Whether to start in debug mode').default(true),
}
lawn.validate(lawnSpec, {})
//=> { PORT: 8000, DEBUG: true }
lawn.validate(lawnSpec, { PORT: "3500", DEBUG: "0" }
//=> { PORT: 3500, DEBUG: false }
lawn.validate(lawnSpec, { PORT: "Yes, please" }
//=> throws "PORT is invalid: 'Yes, please' is not a number"
Returns a string in dotenv format format, including descriptions (if set) and example values.
const lawnSpec = {
PORT: lawn.number
.description('The port to listen on')
.default(8000),
AWS_ACCESS_KEY_ID: lawn.string
.description('The AWS access key for the S3 bucket')
.example('AKIAIOSFODNN7EXAMPLE'),
AWS_SECRET_ACCESS_KEY: lawn.string
.description('The AWS secret key for the S3 bucket')
.example('wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'),
AWS_REGION: lawn.string
.description('The AWS region where the S3 bucket resides')
.default('us-east-1'),
}
lawn.output(lawnSpec)
=> `# The port to listen on
# PORT=8000
# The AWS access key for the S3 bucket
AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
# The AWS secret key for the S3 bucket
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
# The AWS region where the S3 bucket resides
# AWS_REGION=us-east-1`
The default value of the property. If no environment variable is set for this property, then use the default.
A description of the property. This is used when generating an example environment string.
An example value of the property. This is used when generating an example environment string.
Mark the property as optional. If marked as optional and the property does not
exist, lawn.validate
will not throw an error, and instead will not include
the property in its return value.
Declares that this property is a string.
Validate that the string provided matches the given regex. If it does not, the optional description will be displayed as the error message.
const lawnSpec = {
REMOTE_API: lawn.string.regex(/^https?:\/\//i, 'must be an http or https address')
}
lawn.validate(lawnSpec, { REMOTE_API: 'https://example.com' })
//=> { REMOTE_API: 'https://example.com' }
lawn.validate(lawnSpec, { REMOTE_API: 'example.com' })
//=> throws "REMOTE_API is invalid: 'example.com' must be an http or https address"
Declares this this property is an integer.
Declare that this property is a boolean.
Values that resolve to true
are:
"true"
(case-insensitive)"yes"
(case-insensitive)"t"
(case-insensitive)"1"
All other values resolve to false
.
Declares that this property is a URL.
Validate that the URL provided matches the required protocol.
const lawnSepc = {
WEB_API: lawn.url.protocol(/http|https/)
}
lawn.validate(lawnSpec, { WEB_API: 'https://example.com/api' })
//=> { WEB_API: URL { 'https://example.com/api' } }
lawn.validate(lawnSpec, { WEB_API: 'mysql://user:pass@host/database' })
//=> throws "WEB_API is invalid: 'mysql://user:pass@host/database' must have a protocol that matches /http|https/"
For situations where it is useful to use new URL(someComponent, baseUrl)
to build up a URL, preventing confusion by requiring a
trailing slash is useful.
For example, this is often unexpected:
const baseUrl = new URL('s3://bucket-name/folder-name`)
const newKey = new URL('file', baseUrl)
//=> s3://bucket-name/file (not the expected s3://bucket-name/folder-name/file
To reduce issues like this, .requireTrailingSlash
will validate that the
config value does have a trailing slash to prevent confusion.
const lawnSpec = {
S3_STORE: lawn.url.requireTrailingSlash
}
lawn.validate(lawnSpec, { S3_STORE: 's3://bucket/folder/' })
//=> { S3_STORE: URL { 's3://bucket/folder/' } }
lawn.validate(lawnSpec, { S3_STORE: 's3://bucket/folder' })
//=> throws "S3_STORE is invalid: 's3://bucket/folder' must have a trailing slash"
Defaults a query string parameter to the given value.
const lawnSepc = {
MYSQL: lawn.url.defaultQuery('connectionLimit', '8')
}
lawn.validate(lawnSpec, { MYSQL: 'mysql://user:pass@host/database' })
//=> { MYSQL: URL { 'mysql://user:pass@host/database?connectionLimit=8' } }
lawn.validate(lawnSpec, { MYSQL: 'mysql://user:pass@host/database?connectionLimit=2' })
//=> { MYSQL: URL { 'mysql://user:pass@host/database?connectionLimit=2' } }
Forces a query string parameter to the given value. This is useful if a certain query string value needs to be set on the URL.
const lawnSepc = {
MYSQL: lawn.url.overrideQuery('multipleStatements', 'true')
}
lawn.validate(lawnSpec, { MYSQL: 'mysql://user:pass@host/database' })
//=> { MYSQL: URL { 'mysql://user:pass@host/database?multipleStatements=true' } }
lawn.validate(lawnSpec, { MYSQL: 'mysql://user:pass@host/database?multipleStatements=false' })
//=> { MYSQL: URL { 'mysql://user:pass@host/database?multipleStatements=true' } }
FAQs
The environment is dangerous. Your lawn is nice. Stay in your lawn.
The npm package lawn receives a total of 19 weekly downloads. As such, lawn popularity was classified as not popular.
We found that lawn demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PyPI now allows maintainers to archive projects, improving security and helping users make informed decisions about their dependencies.
Research
Security News
Malicious npm package postcss-optimizer delivers BeaverTail malware, targeting developer systems; similarities to past campaigns suggest a North Korean connection.
Security News
CISA's KEV data is now on GitHub, offering easier access, API integration, commit history tracking, and automated updates for security teams and researchers.