
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
A Python library for loading and accessing environment variables from .env
files or StringIO
with type casting. Licensed under GPL 3.
pip install cdotenv
The load
function loads environment variables into os.environ
from a .env
file, a custom file path, or a StringIO
object.
Default .env
file:
from cdotenv import load
load() # Loads from .env in current directory
Custom file path:
from cdotenv import load
from pathlib import Path
load(Path("custom.env"))
StringIO:
from cdotenv import load
from io import StringIO
load(StringIO("KEY=VALUE\n"))
The .env
file should contain KEY=VALUE
pairs, with comments (#
) and empty lines ignored:
# Comment
KEY1=VALUE1
KEY2=VALUE2
The Environ
class allows type-hinted access to environment variables with automatic type conversion.
from cdotenv import Environ
class MyEnviron(Environ):
DEBUG: bool
DATABASE_URL: str
TIMEOUT: int
SEED: float
env = MyEnviron()
print(env.DEBUG) # True if os.environ["DEBUG"] = "true"
print(env.DATABASE_URL) # str, e.g., "postgresql://user:pass@localhost/db"
print(env.TIMEOUT) # int, e.g., 30
print(env.SEED) # float, e.g., 42.5
ValueError
if a variable is missing or cannot be converted to the specified type.AttributeError
for undefined attributes.Use the field
decorator for custom conversion logic:
from cdotenv import Environ, field
class MyEnviron(Environ):
LIST: list = field(lambda x: x.split(","))
env = MyEnviron()
print(env.LIST) # ["a", "b", "c"] if os.environ["LIST"] = "a,b,c"
ValueError
if the converted value does not match the type hint.Missing variable:
class MyEnviron(Environ):
MISSING: str
env = MyEnviron()
env.MISSING # Raises ValueError: "Environment variable 'MISSING' not found"
Invalid type conversion:
os.environ["INVALID"] = "not_an_int"
class MyEnviron(Environ):
INVALID: int
env = MyEnviron()
env.INVALID # Raises ValueError: "Cannot convert 'not_an_int' to int"
Invalid return type:
os.environ["WRONG_TYPE"] = "a,b,c"
class MyEnviron(Environ):
WRONG_TYPE: int = field(lambda x: x.split(","))
env = MyEnviron()
env.WRONG_TYPE # Raises ValueError: "Expected type 'int' for 'WRONG_TYPE', but got 'list'"
The following diagram illustrates the workflow for loading and accessing environment variables:
sequenceDiagram
participant User
participant cdotenv
participant os.environ
User->>cdotenv: load(arg)
alt arg is None
cdotenv->>cdotenv: Use Path(".env")
else arg is Path
cdotenv->>cdotenv: Open file
else arg is StringIO
cdotenv->>cdotenv: Read lines
end
cdotenv->>os.environ: _update_environ(lines)
os.environ->>os.environ: Set KEY=VALUE pairs
User->>cdotenv: Instantiate MyEnviron()
User->>cdotenv: Access env.VARIABLE
cdotenv->>cdotenv: Check type hints
alt VARIABLE defined
cdotenv->>os.environ: Get VARIABLE value
alt Custom field
cdotenv->>cdotenv: Apply custom conversion
else
cdotenv->>cdotenv: Apply type casting
end
cdotenv->>cdotenv: Validate type
cdotenv-->>User: Return value
else
cdotenv-->>User: Raise AttributeError
end
alt VARIABLE missing
cdotenv-->>User: Raise ValueError
else Type conversion fails
cdotenv-->>User: Raise ValueError
end
This project is licensed under the GNU General Public License v3.0 (GPL 3).
FAQs
Load and access environment variables with type casting
We found that cdotenv demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.