Security News
GitHub Removes Malicious Pull Requests Targeting Open Source Repositories
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
strict-env-conf
Advanced tools
NPM package for easy work with ENV-based configuration
Just two examles...
The first idea: if something wrong with your environment variables - your application must crashes on startup, not in arbitrary time when running.
const sec = require('strict-env-conf');
const tpl = {
scopes: {
DB: [
{name: "PASSWORD"}
]
}
};
sec(tpl);
Output:
...
Error: Required env variable DB_PASSWORD is not set
...
The second idea - parsing string values from environment variables to convenient JS-object with several types of properties.
const sec = require('strict-env-conf');
const filters = require('strict-env-conf/src/filters');
const envVars = {
SEC_APP_HOST: 'example.com',
SEC_APP_PORT: '80',
SEC_DB_EXTERNAL_AUTH: 'true',
SEC_DB_PORT: '444',
SEC_LDAP_TEST_USER_EMAIL: 'null',
SEC_LDAP_TEST_USER_ID: '4321',
};
for (let varName in envVars) {
process.env[varName] = envVars[varName];
}
const template = {
prefix: 'SEC_', // env variables app-level prefix for safety
// filters: [str => String(str).trim()] <-- this is by default. Set "filters: []" to avoid this behavior.
scopes: {
APP: [
{name: "HOST", default: "localhost"},
{name: "PORT", default: 3000} // "filters: [Number]" is redundant here, Number is default filter if (typeof default === 'number')
],
DB: [
{name: "EXTERNAL_AUTH", default: false}, // default filter for boolean types works with "0", "1", "true", "false"
{name: "PORT", filters: [Number]}, // no default value here, just the Number filter - the variable is required
{name: "NAME", default: "my-app"}
],
LDAP: [
{name: "TEST_USER_LOGIN", default: undefined}, // if default === undefined - you must check in your application code what conf object have this property
{name: "TEST_USER_EMAIL", default: undefined, filters: [filters.maybeNull]},
{name: "TEST_USER_ID", default: undefined, filters: [Number]},
],
DATA: [
{name: "CATEGORIES", default: "2,1,E", filters: [filters.csv2array]}, // you also can use your own filters. Filter function example: stringValue => 'MY_' + stringValue
],
}
};
const testConf = sec(template);
console.log(JSON.stringify(testConf, null, ' '));
Output:
{
"app": {
"host": "example.com",
"port": 80
},
"db": {
"external_auth": true,
"port": 444,
"name": "my-app"
},
"ldap": {
"test_user_email": null,
"test_user_id": 4321
},
"data": {
"categories": [
"2",
"1",
"E"
]
}
}
npm i strict-env-conf
MIT
FAQs
NPM package for easy work with ENV-based configuration
The npm package strict-env-conf receives a total of 0 weekly downloads. As such, strict-env-conf popularity was classified as not popular.
We found that strict-env-conf demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
Security News
RubyGems.org has added a new "maintainer" role that allows for publishing new versions of gems. This new permission type is aimed at improving security for gem owners and the service overall.
Security News
Node.js will be enforcing stricter semver-major PR policies a month before major releases to enhance stability and ensure reliable release candidates.