
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Geomancy makes it easy to check and validate environments, such as development, testing and production.
Environment checks and tests are helpful for testing the correct setting of environment variables, the installation and versions of installed executables, the state of external dependencies, like LaTeX packages, or cloud resources, or for checking environments that use the 12-factor principles.
Layered environments could include a common or base environment, with additional checks for settings of test, development and production environments.
In the following checks file, the existence of an environment file and a secrets
file can be checked based on the $ENV
environment variable. (See the
docker environment variable parameter expansion rules)
checks:
Environment:
desc: Check environment variables in different deployments
CheckEnvFile:
desc: Check the existence of the environment file
checkPath: "deployments/${ENV}/.env"
CheckSecretsFile:
desc: Check the existence of the secrets file
checkPath: "deployments/${ENV}/.secrets"
This check file can be used to check multiple environments:
# check "dev" environment
$ geo -e deployments/base/.env -e deployments/dev/.env checks.yaml
...
# check "test" environment
$ geo -e deployments/base/.env -e deployments/test/.env checks.yaml
...
In this case, deployments/dev/.env
is an
environment file
that sets ENV=dev
, deployments/test/.env
is an
environment file
that sets ENV=test
.
Environment files are loaded using the -e/--env
option,
which can be layered for different environments.
# Run checks for 'dev' environment
$ geo -e deployments/base/.env -e deployments/dev/.env check
...
# Run checks for 'test' environment
$ geo -e base.env -e test.env run -- echo "Test environment"
The following example concurrently checks that the 3 AWS S3 buckets are accessible using the current credentials and are secured.
This example is in yaml format, and checks can be formatted in toml format as well.
AWS:
TemplateS3:
checkS3: myproject-cfn-templates
StaticS3:
checkS3: myproject-static
MediaS3:
checkS3: myproject-media
Including yaml (e.g. .geomancy.yaml
)
checks:
Environment:
desc: Check environment variables common to all development environments
Path:
decs: Search paths for executables
checkEnv: $PATH
or toml (e.g. .geomancy.toml
)
[checks.Environment]
desc = "Check environment variables common to all development environments"
[checks.Environment.Path]
desc = "Search paths for executables"
checkEnv = "$PATH"
or toml with each check on 1 line (e.g. .geomancy.toml
)
[Checks.Environment]
Path = {checkEnv = "$PATH", desc = "Search paths for executables"}
[tool.geomancy.checks.Environment]
desc = "Check environment variables common to all development environments"
[tool.geomancy.checks.Environment.Path]
desc = "Search paths for executables"
checkEnv = "$PATH"
The following shows an example in yaml format. Checks can be formatted in toml format as well.
OperatingSystem:
desc: Check the minimum operating system versions
subchecks: any
checkMacOS:
desc: MacOS 10.9 or later (released 2013)
checkOS: "macOS >= 10.9"
checkLinuxOS:
desc: Linux 4.0 or later (released 2015)
checkOS: "Linux >= 3.0"
checkWindows:
desc: Windows 10 or later (released 2015)
checkOS: "Windows >= 10"
The following shows an example in yaml format. Checks can be formatted in toml format as well.
Username:
desc: The current username
checkEnv: "$USER"
regex: "[a-z_][a-z0-9_-]*[$]?"
The following shows an example in yaml format. Checks can be formatted in toml format as well.
PyprojectToml:
desc: A project's pyprojectfile
checkPath: ./pyproject.toml
type: file
The following shows an example in yaml format. Checks can be formatted in toml format as well.
Python:
desc: Python interpreter (version 3.11 or higher)
checkExec: "python3>=3.11"
The following shows an example in yaml format. Checks can be formatted in toml format as well.
PythonPackages:
geomancy:
desc: Geomancy python package
checkPythonPkg: "geomancy>=0.1"
The following shows an example with the checks
group containing 2 groups,
OperatingSystem
, Environment
.
The OperatingSystem
group contains 3 checks: checkMacOS
,
checkLinuxOS
, checkWindows
, and the OperatingSystem
group check
passes if any of these 3 checks pass (subchecks: any
)
The Environment
group contains 1 check, Path
, and 1 group, Username
,
which itself contains 2 checks: UnixUsername
and WindowsUsername
.
This example is in yaml format, and checks can be formatted in toml format as well.
checks:
OperatingSystem:
desc: Check the minimum operating system versions
subchecks: any
checkMacOS:
desc: MacOS 10.9 or later (released 2013)
checkOS: "macOS >= 10.9"
checkLinuxOS:
desc: Linux 4.0 or later (released 2015)
checkOS: "Linux >= 3.0"
checkWindows:
desc: Windows 10 or later (released 2015)
checkOS: "Windows >= 10"
Environment:
desc: Check environment variables common to all development environments
Path:
decs: Paths to search for executables
checkEnv: $PATH
Username:
subchecks: any
UnixUsername: # Username on linux and macOS
desc: The current username
checkEnv: $USER
regex: "[a-z_][a-z0-9_-]*[$]?"
WindowsUsername: # Username on Windows
desc: The current username
checkEnv: $USERNAME
regex: "[a-z_][a-z0-9_-]*[$]?"
The following shows an example in yaml format. Checks can be formatted in toml format as well.
AWS:
IAM:
desc: Check the default authentication and security settings
checkIAM:
TemplatesS3Bucket:
desc: Check the bucket for cloudformation templates
checkS3: "myproject-cfn-templates"
Create a .geomancy.yaml
file with checks. See
examples/geomancy.yaml
for an example of all checks.
Environment:
desc: Check environment variables common to all development environments
Username:
desc: The current username
checkEnv: "$USER"
regex: "[a-z_][a-z0-9_-]*[$]?"
Paths:
desc: Checks the existence of needed files and directories
subchecks: "any" # at least one of the files must be present
Geomancy:
desc: Check for the 'geomancy.toml' file
checkPath: examples/geomancy.toml
type: file
Pyproject:
desc: Check for 'pyproject.toml' file
checkPath: examples/pyproject.toml
type: file
Executables:
desc: Check the availability of commands and their versions
Python:
desc: Python interpreter ver 3.11 or higher
checkExec: python3>=3.11
Use geo
to run the checks.
[✔] test.yaml...passed
[✔] Environment...passed
[✔] Check environment variable '$USER'...passed
[✔] Paths...passed
[✔] Check path 'examples/geomancy.toml'...passed
[✔] Check path 'examples/pyproject.toml'...passed
[✔] Executables...passed
[✔] Check executable 'python3>=3.11'...passed
================================= 8 passed in 0.50s ==================================
(By default, geomancy
will search .geomancy.y[a]ml
, geomancy.y[a]ml
.geomancy.toml
, geomancy.toml
and pyproject.toml
.)
For full documentation please see https://geomancy.readthedocs.io/en/latest.
Please use the GitHub issue tracker to submit bugs or request features.
The following projects share some of the same goals in different contexts:
Copyright Justin Lorieau and others, 2023.
Distributed under the terms of the MIT license. geomancy is free and open source software.
FAQs
Geomancy validates deployment and development environments
We found that geomancy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.